SonicWall Patches Critical CVSS 10.0 SSRF Flaw in SMA1000 VPNs

SonicWall has patched a maximum-severity, pre-authentication server-side request forgery (SSRF) vulnerability in its SMA1000 series secure access gateways that an unauthenticated attacker can use to make the appliance issue requests on their behalf and reach internal functionality. The flaw, tracked as CVE-2026-102255, carries a CVSS base score of 10.0 — the highest possible rating — and sits in the Work Place interface that SMA1000 appliances expose to remote users logging in over the internet. SonicWall disclosed it, alongside three lower-severity bugs, in advisory SNWLID-2026-0017 on October 7, 2026.

As of this writing, SonicWall says it has no evidence of active exploitation, and the bug has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. That is a genuinely different posture from the two other critical SMA1000 flaws SonicWall patched earlier this same year, both of which CISA did add to KEV and both of which it flagged for known ransomware-campaign use. Given that pattern, and given that a pre-auth SSRF needs no stolen credentials and no user interaction to trigger, SMA1000 administrators should treat this as a patch-now issue rather than wait for confirmation of exploitation.

The flaw: an unauthenticated detour into the appliance's internals

SMA1000 appliances — SonicWall's higher-end line of secure remote access gateways, aimed at larger organizations that want to keep sensitive infrastructure on-premises rather than move it to the cloud — present two separate web interfaces: the Work Place portal that end users log into for remote access, and the Appliance Management Console (AMC) that administrators use to configure the box. CVE-2026-102255 lives in the first of those, the one that is normally reachable from the open internet without any login at all.

According to SonicWall's own advisory text, the vulnerability exists because of "an unintended alternate access path" in the Work Place interface. By abusing that path, a remote, unauthenticated attacker can "direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations." In plainer terms: the appliance can be tricked into acting as a proxy for the attacker, sending requests to internal systems or internal services that were never meant to be internet-facing. That is the textbook definition of SSRF, and it is also why SonicWall's own advisory tags the bug with two CWE identifiers rather than one — CWE-918 (Server-Side Request Forgery) and CWE-441 (Unintended Proxy or Intermediary, also called the "confused deputy" problem). The appliance, in effect, becomes a deputy that executes an attacker's instructions while believing it is doing its own job.

Because the bug requires no authentication, no user interaction, and has low attack complexity, it earned the maximum possible CVSS score. SonicWall's advisory lists the vector as CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; CISA's Vulnrichment program separately recalculated the same flaw under the newer CVSS 3.1 standard and arrived at the identical 10.0 critical score, with confidentiality, integrity, and availability impact all rated High and the scope marked as "Changed" — meaning a successful attack can affect resources beyond the vulnerable component itself. NVD's Stakeholder-Specific Vulnerability Categorization (SSVC) rates the flaw's technical impact as "total" and notes it is "automatable," language CISA reserves for bugs that lend themselves to scripted, large-scale scanning and exploitation rather than one-off manual attacks.

Three more bugs patched in the same release

SNWLID-2026-0017 is a four-vulnerability advisory, and the other three are worth knowing about even though none of them comes close to the severity of the SSRF.

CVE-2026-102256 is a post-authentication OS command injection bug in the SMA1000 appliance that SonicWall says could, "in specific conditions," let an authenticated administrator execute arbitrary OS commands and achieve remote code execution. CVE-2026-102257 is a classic Zip Slip flaw in the AMC's archive-extraction handling: a specially crafted archive uploaded by an admin-level attacker can write files outside the directory the appliance intended, which SonicWall also says can lead to code execution. CVE-2026-102258 is a stored XSS bug in the AMC that lets an authenticated administrator store JavaScript that later executes in another user's session. All three require administrator-level authentication first, which substantially limits who can use them — but they become meaningfully more dangerous when chained after the pre-auth SSRF, since a successful SSRF exploit against the Work Place interface could plausibly be a stepping stone toward reaching the AMC itself.

SonicWall's advisory is explicit that SSL-VPN running on SonicWall firewall products (the SonicOS/SonicWall TZ and NSa-class devices) is not affected by any of the four vulnerabilities in this advisory — this one is scoped to the SMA1000 line only.

Which SMA1000 models and firmware are affected

SonicWall's SMA1000 series ships in three forms, per the vendor's own product materials: the SMA 6210 and SMA 7210 physical appliances, and the SMA 8200v virtual appliance for VMware, Hyper-V, KVM, and public-cloud deployments. All three run on the same underlying Linux-based platform code, and NVD's published record for CVE-2026-102255 lists the affected baseline as SonicWall SMA1000 on Linux, version 12.4.3-03526 (platform-hotfix) and older, and version 12.5.0-02952 (platform-hotfix) and older.

SonicWall's public advisory text tells customers to "upgrade to the mentioned fixed release version" but, as rendered on the PSIRT portal, does not spell out a single fixed build number on the page itself, and the exact cutoff has shifted at least once since initial disclosure. A follow-up government cybersecurity alert, updated two days after SonicWall's original publication, listed a materially newer firmware line — 12.4.3-03670 and 12.5.0-03082 — as still within the affected range, which suggests the first round of hotfixes that shipped around October 7 did not fully close the hole for every customer. Given that uncertainty, the safe move is not to trust any single number (including the ones in this article): log into MySonicWall, check the exact platform-hotfix build currently installed, and install whatever SonicWall marks as the current fixed release for the 12.4.3.x or 12.5.0.x branch today, rather than the first hotfix that appeared after October 7.

Is CVE-2026-102255 being exploited right now?

SonicWall's advisory states plainly: "There is currently no evidence any of the vulnerabilities addressed in this release are being exploited in the wild." NVD's SSVC assessment, pulled from the same CVE record, lists exploitation status as "none" as of publication. Checking CISA's Known Exploited Vulnerabilities catalog directly confirms CVE-2026-102255 is not currently listed there.

That is worth taking at face value rather than either dismissing or overstating. It does not mean the flaw is safe to leave unpatched — a maximum-severity, unauthenticated, internet-reachable SSRF in an enterprise VPN gateway is exactly the kind of bug that attackers reverse-engineer from a patch diff within days of disclosure, and SonicWall's SMA1000 line has a well-documented history (below) of moving from "no evidence of exploitation" to "actively exploited" in a matter of weeks. Treat the absence of a KEV listing as a head start, not a pass.

The third critical SMA1000 flaw to hit CISA's radar this year

CVE-2026-102255 is not SonicWall's first maximum-severity SMA1000 SSRF of 2026 — it is the third. In July, SonicWall disclosed CVE-2026-15409, another CVSS 10.0 pre-authentication SSRF in the same product line, alongside a companion code-injection bug, CVE-2026-15410. CISA added both to its KEV catalog on July 14, 2026, and flagged both for known use in ransomware campaigns. In September, SonicWall patched another pair — CVE-2026-83548, again a pre-authentication SMA1000 SSRF, this time paired with a post-authentication OS command injection bug, CVE-2026-83549. CISA added that pair to KEV on September 2, 2026 as well.

That is three separate pre-auth SSRF disclosures in the SMA1000 Work Place interface inside a single year, two of which were confirmed exploited and tied to ransomware activity by the time CISA catalogued them. The pattern says something important about how attackers are approaching this product line: once a class of bug (here, SSRF via an unintended access path into the Work Place portal) is shown to work once, researchers and attackers alike go looking for sibling bugs in the same code area. Organizations that patched the July and September flaws should not assume they are now clear of this family of issues — October's CVE-2026-102255 lives in conceptually the same part of the appliance.

Why a pre-auth SSRF in a VPN gateway is so dangerous

SSRF bugs are routinely underestimated relative to more headline-grabbing bug classes like remote code execution, but in a device like an SMA1000 appliance — which sits at the network edge specifically so that it can bridge the public internet and an organization's internal network — an SSRF is close to worst-case. The entire design purpose of the box is to selectively let outside traffic reach internal resources once a user has authenticated. A pre-auth SSRF skips the "once a user has authenticated" part entirely: it lets an attacker make the appliance itself originate requests toward whatever internal services, management interfaces, or cloud metadata endpoints it can otherwise reach, without ever needing a username or password.

That is also why SSRF bugs so often function as the first domino rather than the whole attack. An attacker who can get the SMA1000 to make requests on their behalf can use that access to probe internal network topology, reach administrative endpoints that were never meant to be internet-exposed, or potentially pivot toward the very AMC interface that CVE-2026-102256 through CVE-2026-102258 target with post-authentication bugs. Enterprise remote-access gateways from multiple vendors have followed this same chain-of-flaws pattern in 2026 — our coverage of the Ivanti Connect Secure chain disclosed earlier this year showed a near-identical dynamic, where an initial access bug became significantly more dangerous once paired with a second, authenticated flaw in the same product.

What to do now: patch steps and mitigations

1. Identify every SMA1000 appliance you run — physical SMA 6210/7210 units and SMA 8200v virtual instances alike — and note the exact platform-hotfix build currently installed via the AMC or MySonicWall.
2. Apply the current fixed hotfix for your branch (the 12.4.3.x or 12.5.0.x platform-hotfix line) rather than assuming an older hotfix is sufficient; as noted above, the affected-version boundary has already moved once since initial disclosure.
3. Restrict and monitor access to the Work Place interface where possible while you schedule patching — geo-fencing, WAF rules, or temporarily limiting exposure to known user IP ranges can reduce the attack surface for an unauthenticated SSRF, though SonicWall's advisory does not list this as a substitute for patching.
4. Tighten AMC access separately — since CVE-2026-102256 through CVE-2026-102258 all require administrator authentication, enforcing strong credentials, MFA, and IP allow-listing on the AMC meaningfully reduces the post-auth attack surface even before every appliance is patched.
5. Review logs for anomalous outbound or internal requests originating from the SMA1000 covering the period since October 7, 2026, looking for connection attempts toward internal services the appliance would not normally reach on its own.
6. Watch SonicWall's advisory and CISA's KEV catalog for updates. Given this product line's 2026 track record — two of three SMA1000 SSRFs disclosed this year were later confirmed exploited and added to KEV — a status of "no evidence of exploitation" at disclosure time should not be treated as permanent.

For broader context on how threat actors typically weaponize a freshly disclosed edge-device flaw like this one, see our explainer on the APT attack lifecycle; the pattern of an initial-access bug in internet-facing infrastructure being chained into deeper compromise is the same one driving urgency around other critical, actively-targeted flaws CISA has flagged this year.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage