SonicWall Issues Emergency Hotfixes for Maximum-Severity Pre-Auth SSRF in SMA1000 Gateways
SonicWall has rolled out emergency hotfixes to resolve four distinct security flaws targeting its enterprise-grade Secure Mobile Access (SMA) 1000 series products. Leading the advisory is CVE-2026-102255, a maximum-severity, pre-authentication server-side request forgery (SSRF) flaw residing directly inside the Appliance WorkPlace interface. The issue stems from an unintended alternate access-path weakness that enables unauthenticated attackers to execute low-complexity network calls on behalf of the appliance. By leveraging this unauthorized path, external actors can force the device to query trusted internal endpoints and trigger unauthorized operations that normally require administrative credentials. Alongside this flaw, SonicWall patched CVE-2026-102256, an authenticated OS command injection bug also discovered by researcher Benoît Sevens. The release also covers CVE-2026-102257 and CVE-2026-102258, which represent path traversal and cross-site scripting vulnerabilities in the Appliance Management Console discovered by Brian Mariani. The impacted lineup consists of the 6210 and 7210 hardware appliances as well as the virtual 8200v platform. Neither the SMA 100 series nor the core SonicOS firewall SSL-VPN stacks share this vulnerable codebase. While vendor telemetry has not yet identified active exploitation, internet scans by Shadowserver revealed over 400 exposed SMA1000 installations visible online. SonicWall has urged administrators to immediately deploy hotfixes 12.4.3-03670, 12.5.0-03082, or later releases. This update follows a persistent assault on the platform throughout 2026, including zero-day chains CVE-2026-15409, CVE-2026-15410, CVE-2026-83548, and CVE-2026-83549, which delivered custom payloads such as `OrangeTail` and `RootRun`.
Commentary
Edge appliances that straddle perimeter networks and internal management subnets remain an immediate target for persistent threat actors, and the SMA1000 series sits right in that crosshairs. Even though the exposed footprint is modest at around 400 instances globally, the deployment profile makes every single box a jackpot: large enterprises, MSSPs, and government entities use these gateways specifically to terminate remote access to sensitive core infrastructure. What makes pre-auth SSRF flaws like CVE-2026-102255 so lethal in real-world intrusion operations is how cleanly they chain. Pair an unauthenticated SSRF that tricks the appliance's local daemon into querying internal management ports—bypassing external ACLs—with authenticated issues like the OS command injection flaw (CVE-2026-102256) patched in the same advisory, and an attacker has a textbook pre-auth remote code execution path. Threat actors have repeatedly demonstrated this exact playbook against this firmware family over the past year, dropping implant suites like `Sou5` and `RootRun`. Organizations running SMA1000 hardware (6210, 7210) or the `8200v` virtual machine must apply build versions `12.4.3-03670` or `12.5.0-03082` without delay. Beyond applying vendor hotfixes, security teams should inspect reverse proxy and web access logs targeting the Appliance WorkPlace portal for irregular URI routing or off-path requests, while verifying that management interfaces (`Appliance Management Console`) are strictly unreachable from public interfaces.
The Quote to Remember
“By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations”
“There is currently no evidence any of the vulnerabilities addressed in this release are being exploited in the wild.”