SonicWall SMA 1000 Flaw: CVSS 10.0 SSRF Needs Urgent Patch

A SonicWall SMA 1000 vulnerability rated CVSS 10.0 lets attackers reach internal systems without logging in. Here is what the flaw is, which devices are affected, and how to patch it right now.

What Happened

On October 6, 2026, SonicWall published security advisory SNWLID-2026-0017 covering four vulnerabilities in its SMA 1000 series appliances. These are the gateway boxes that let remote workers connect securely into a company network from home or on the road.

The headline flaw is CVE-2026-102255, a server-side request forgery (SSRF) bug in the appliance's WorkPlace portal, the login page remote users visit. It scores a perfect 10.0 on the CVSS scale because it can be abused over the network with no credentials and no user interaction.

SonicWall says it currently has no evidence the flaws are being exploited in the wild, but strongly advises customers to install the fixed firmware as soon as possible.

Image: SonicWall

The Four Flaws, in Plain English

Here is the full list from the advisory:

• CVE-2026-102255 (CVSS 10.0) - SSRF in WorkPlace: the critical one. An attacker with no login can trick the appliance into sending requests on their behalf, reaching internal functions and performing unauthorized operations. SonicWall classifies it under CWE-918 and calls out an "unintended alternate access path" that lets the device act as a forward proxy.
• CVE-2026-102256 (CVSS 7.8) - OS command injection: an authenticated administrator could run arbitrary operating-system commands, leading to full remote code execution under specific conditions.
• CVE-2026-102257 (CVSS 7.2) - Zip Slip in the Appliance Management Console (AMC): a specially crafted archive file can be used to write files outside the intended folder, a path-traversal trick that can also lead to remote code execution.
• CVE-2026-102258 (CVSS 5.5) - stored cross-site scripting (XSS) in AMC: an authenticated administrator could store malicious JavaScript that later runs in the management console.

The SSRF flaw was reported by Benoît Sevens of Anthropic, who also reported the command-injection bug. Brian Mariani reported the Zip Slip issue through Trend Micro's Zero Day Initiative, and DigitalCanion SA received credit for the stored XSS.

Only the SSRF flaw needs no credentials at all. That is what makes it the one to worry about first.

What Is SSRF, Exactly?

If the term "server-side request forgery" sounds intimidating, here is the simple version. Normally, your web server talks to internal systems on your behalf: you ask for a page, the server fetches what it needs from behind the scenes. An SSRF bug lets an attacker choose what the server fetches.

Imagine a reception desk at a secure office building. The receptionist is trusted to call any internal extension. An attacker walks up and says, "Please call extension 402 and read me what they say." The receptionist does it, because the request looks legitimate. The attacker never got past the front desk, but still reached the inside.

In this case, the SMA 1000 appliance is the receptionist, and the "extensions" are internal network functions that are supposed to be reachable only from inside the company. An unauthenticated attacker on the internet can push requests through the appliance to reach them. For more cybersecurity news explained this way, browse our cybersecurity coverage.

Am I Affected?

The flaws affect the physical and virtual SMA 1000 models 6210, 7210, and 8200v running these platform-hotfix builds:

• Branch 12.4.3: version 12.4.3-03526 and earlier are affected; upgrade to 12.4.3-03670 or later.
• Branch 12.5.0: version 12.5.0-02952 and earlier are affected; upgrade to 12.5.0-03082 or later.

There is one important trap here: 12.4.3-03526 and 12.5.0-02952 were the fixes for two earlier flaws that SonicWall disclosed on September 1 as actively exploited. If your team installed that September update, your appliance still needs this new hotfix. The old patch does not protect against the new bugs.

Not affected: SSL-VPN services running on SonicWall firewall products, and the discontinued SMA 100 series. If all your remote access runs through SonicWall firewalls rather than dedicated SMA 1000 boxes, this advisory does not apply to you.

What To Do Right Now

SonicWall lists no workaround, so patching is the only fix. Here is the checklist:

• Download the hotfix from the MySonicWall portal and install it. The appliance restarts when the installation finishes, so schedule a short maintenance window.
• Confirm the build number after the update: 12.4.3-03670 or later on the 12.4.3 branch, 12.5.0-03082 or later on the 12.5.0 branch.
• Check the appliance logs for unusual activity, especially requests to the WorkPlace interface that do not match normal login traffic.
• Limit management access: make sure the Appliance Management Console is reachable only from trusted internal networks, not the open internet.
• Review user sessions if your appliance is internet-facing. Unlike the July and September advisories, SonicWall has not told customers to re-image appliances or reset passwords this time, but a quick log review costs nothing.

A Worrying Pattern: Third Time This Year

This is not SonicWall's first rodeo with this exact problem. In July 2026, the company disclosed a pair of flaws including a 10.0-rated SSRF in the same WorkPlace interface, which SonicWall said had been exploited in "multiple cases" of attacks. In September, it disclosed another pair, again including a pre-authentication SSRF, with "a case" of exploitation. Both earlier rounds followed the same shape: one flaw that needs no login, plus a second flaw that lets a logged-in administrator run commands.

The pattern matters because these gateways sit directly on the internet and guard the keys to the corporate network. Attackers know this, which is why remote-access appliances have become one of ransomware groups' favorite entry points. Patching the firmware is step one. Restricting who can reach the login portal from the internet is the habit that makes the next round hurt less.

For context on similar gateway emergencies, see our cybersecurity and technology coverage.

Sources: The Hacker News, SecurityWeek, Cyber Security News