SonicWall Issues Emergency Hotfixes for Maximum-Severity Pre-Auth SSRF in SMA1000 Gateways
SonicWall has rolled out emergency hotfixes to resolve four distinct security flaws targeting its enterprise-grade Secure Mobile Access (SMA) 1000 series products. Leading the advisory is CVE-2026-102255, a maximum-severity, pre-authentication server-side request forgery (SSRF) flaw residing directly inside the Appliance WorkPlace interface. The issue stems from an unintended alternate access-path weakness that enables unauthenticated attackers to execute low-complexity network calls on behalf of the appliance. By leveraging this unauthorized path, external actors can force the device to query trusted internal endpoints and trigger unauthorized operations that normally require administrative credentials. Alongside this flaw, SonicWall patched CVE-2026-102256, an authenticated OS command injection bug also discovered by researcher Benoît Sevens. The release also covers CVE-2026-102257 and CVE-2026-102258, which represent path traversal and cross-site scripting vulnerabilities in the Appliance Management Console discovered by Brian Mariani. The impacted lineup consists of the 6210 and 7210 hardware appliances as well as the virtual 8200v platform. Neither the SMA 100 series nor the core SonicOS firewall SSL-VPN stacks share this vulnerable codebase. While vendor telemetry has not yet identified active exploitation, internet scans by Shadowserver revealed over 400 exposed SMA1000 installations visible online. SonicWall has urged administrators to immediately deploy hotfixes 12.4.3-03670, 12.5.0-03082, or later releases. This update follows a persistent assault on the platform throughout 2026, including zero-day chains CVE-2026-15409, CVE-2026-15410, CVE-2026-83548, and CVE-2026-83549, which delivered custom payloads such as `OrangeTail` and `RootRun`.
Read more about SonicWall Issues Emergency Hotfixes for Maximum-Severity Pre-Auth SSRF in SMA1000 Gateways