SonicWall SMA1000: pre-auth SSRF flaw CVE-2026-102255

SonicWall has released fixes for four vulnerabilities in its SMA1000 appliances, the SSL VPN remote access gateways of the Secure Mobile Access 1000 series. The most serious one, CVE-2026-102255, carries the maximum CVSS score of 10.0: it is a server-side request forgery (SSRF) flaw that can be exploited without authentication through the Work Place interface, the portal users connect to.

According to SonicWall, there is no evidence of exploitation so far. There is no workaround either: installing the update is the only defence.

What happened

The Work Place interface contains an unintended alternate access path. By abusing it, a remote attacker with no credentials can make the appliance send requests on their behalf, reaching internal SMA1000 functions and performing unauthorised operations. No user interaction is required.

The 10.0 score reflects exactly this: a network attack, low complexity, no privileges required and, as an analyst quoted by CSO Online points out, effects that reach beyond the vulnerable component (the scope change in the CVSS metric). A VPN gateway is by design allowed to talk to the internal network, and an SSRF on this kind of appliance abuses that very trust.

Alongside CVE-2026-102255, SonicWall fixed three more vulnerabilities, all of which can only be exploited by an authenticated user.

Technical details

• CVE-2026-102255, CVSS 10.0: pre-authentication SSRF in the Work Place interface, caused by an unintended alternate access path.
• CVE-2026-102256, CVSS 7.8: operating system command injection. Security Affairs describes it as exploitable by an authenticated administrator; CSO Online speaks of a remote authenticated attacker who can gain administrator privileges and run arbitrary commands.
• CVE-2026-102257, CVSS 7.2: a Zip Slip flaw (path traversal while extracting an archive) in the Appliance Management Console; it allows files to be written outside the intended directory and can lead to remote code execution.
• CVE-2026-102258, CVSS 5.5: stored cross-site scripting in the management console, exploitable by an authenticated user.
• Affected models: SMA1000 6210, 7210 and 8200v.
• Affected versions: 12.4.3-03526 (platform-hotfix) and earlier; 12.5.0-02952 (platform-hotfix) and earlier.
• Fixed versions: 12.4.3-03670 and 12.5.0-03082 or later, available from the MySonicWall portal.
• Not affected: SSL VPN on SonicWall firewalls and the SMA 100 series.
• Exploitation: no evidence so far, according to SonicWall.
• MITRE ATT&CK: any exploitation of CVE-2026-102255 would fall under T1190 (Exploit Public-Facing Application).

Context: another critical flaw within a few months

This is not the first serious SMA1000 vulnerability this year. In September SonicWall fixed CVE-2026-83548 (CVSS 10.0) and CVE-2026-83549 (CVSS 7.8) after confirming active exploitation; according to Security Affairs, attackers were likely chaining them to achieve arbitrary code execution. CSO Online also recalls CVE-2026-15409, another CVSS 10 flaw, exploited as a zero-day in July.

There is also a practical detail, highlighted by the analyst quoted by CSO Online: the builds listed as vulnerable, 12.4.3-03526 and 12.5.0-02952, are the same ones that fixed the September vulnerabilities. Anyone who updated last month has to update again.

Impact for European and Italian organisations

SMA1000 appliances are used by medium and large enterprises, managed security service providers and public bodies to provide remote access to the internal network. They sit on the perimeter and must reach internal systems, which is what makes them an attractive target. According to CSO Online, over the last four years CISA has added 19 SonicWall vulnerabilities to its catalogue of exploited vulnerabilities, 13 of which were used in ransomware attacks.

For entities within the scope of NIS2, timely handling of vulnerabilities in exposed systems is part of the required security measures; should signs of compromise emerge, the incident must be assessed for notification to the national CSIRT, which in Italy is CSIRT Italia at ACN. In healthcare, remote access for staff and suppliers often goes through gateways of this kind, and a compromised appliance brings the attacker closer to the systems that process clinical data.

What to do now

1. Inventory: identify every SMA1000, physical and virtual, and check the full build installed on each one, not just the branch.
2. Update: move the 12.4.3 branch to 12.4.3-03670 and the 12.5.0 branch to 12.5.0-03082, or later. There is no alternative to updating.
3. Reduce exposure: where possible, do not leave the management console and the Work Place interface reachable from the whole internet, as the analyst quoted by CSO Online recommends.
4. Check the logs: look for anomalous requests to the Work Place interface and for connections from the SMA1000 to internal systems it does not normally contact.
5. If the appliance was exposed and unpatched in July or September: treat the update as the start of an investigation, not the end. After the previous incidents SonicWall advised re-imaging the appliance, changing passwords and resetting the TOTP codes used for two-factor authentication; according to CSO Online this advice still stands.

How ARXDOME helps

ARX Expose shows which services your company exposes on the internet, which products are recognised on them and which have known vulnerabilities: it helps you find out whether a remote access portal or a management console is reachable from outside. ARX Sentry collects firewall, server and computer logs in one central place, so anomalous connections to and from the gateway stay in front of the analysts. With ARX Horizon you can look up vulnerability details from the portal.

Last updated: 8 October 2026