SonicWall Releases Critical Security Advisory for SMA1000 Series Appliances

Security updates address four vulnerabilities, including a maximum severity unauthenticated SSRF vulnerability

Threat ID:: CC-4863
Threat Severity:: Medium
Published:: 8 October 2026 2:53 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Security updates address four vulnerabilities, including a maximum severity unauthenticated SSRF vulnerability

Affected platforms

The following platforms are known to be affected:

SonicWall Secure Mobile Access (SMA) 1000 Series

Models 6210, 7210, and 8200v running:

12.4.3-03526 (platform-hotfix) and older versions
12.5.0-02952 (platform-hotfix) and older versions.

Note: These vulnerabilities do not affect SSL-VPN running on SonicWall firewalls or the SMA 100 Series product line.

Threat details

Active Exploitation Attempts of CVE-2026-102255

Security researchers have reported exploitation attempts of CVE-2026-102255 against honeypots.

The NHS England National CSOC assesses future exploitation of these vulnerabilities as almost certain.

Firewalls and other edge devices are internet-facing by design and are highly attractive targets to attackers, and there is an increasing number of edge device vulnerabilities disclosed each year that are rapidly exploited by attackers. Organisations are strongly encouraged to follow NCSC's vulnerability management guidance, including patching edge devices as soon as possible if a critical vulnerability is identified.

Introduction

SonicWall has released a security advisory to address multiple vulnerabilities in SMA1000 Series Appliances.

CVE-2026-102255 - 'Server-Side Request Forgery (SSRF)' vulnerability - CVSSv3 score: 10.0.
CVE-2026-102256 - 'OS Command Injection' vulnerability - CVSSv3 score: 7.8.
CVE-2026-102257 - 'Path Traversal' vulnerability - CVSSv3 score: 7.2.
CVE-2026-102258 - 'Cross-Site Scripting' vulnerability - CVSSv3 score: 5.5.

Threat updates

Date	Update
12 Oct 2026	Updated following reports of exploitation attempts The following section has been added: Emphasis Box

Date

Update

12 Oct 2026

Updated following reports of exploitation attempts

The following section has been added:

Emphasis Box

Remediation advice

Affected organisations are encouraged to review SonicWall's security advisory SNWLID-2026-0017 and apply the relevant updates as soon as possible.

Definitive source of threat updates

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017

CVE Vulnerabilities

Status Published

CVE-2026-102255

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.

Status Published

CVE-2026-102256

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.

Status Published

CVE-2026-102257

A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the intended destination directory using a specially crafted archive, resulting in remote code execution.

Status Published

CVE-2026-102258

Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code in the Appliance Management Console (AMC).

Last edited: 12 October 2026 3:17 pm