CybersecurityVulnerability Management

SonicWall Fixes CVSS 10.0 Flaw in SMA1000 Appliances

Analyst 207||Source: TheHackerNews
Network appliance sits on a rack in a data center room with server racks and patch panels.

"reach internal functionality and perform unauthorized operations," SonicWall said in its security advisory, dated October 6.

CVE-2026-102255: a pre-auth SSRF in WorkPlace

SonicWall on October 6 published hotfixes for four vulnerabilities affecting its SMA1000 appliances and identified the most serious as CVE-2026-102255, a server-side request forgery (SSRF) bug in WorkPlace, the portal used by SMA1000 users to log in. According to SonicWall, the issue is reachable before authentication because of "an unintended access path through SonicWall," and an attacker who abuses that path could "reach internal functionality and perform unauthorized operations." SonicWall rated the flaw 10.0 on the CVSS scale and said it has "no evidence that any of the four flaws is being used in attacks."

Affected models and exact firmware windows

All four flaws affect SMA1000 models 6210, 7210 and 8200v when running the listed platform-hotfix versions. Specifically:

  • Version 12.4.3: 12.4.3-03526 and older versions are affected; 12.4.3-03670 and higher versions are fixed.
  • Version 12.5.0: 12.5.0-02952 and older versions are affected; 12.5.0-03082 and higher versions are fixed.

SonicWall noted that the affected versions include 12.4.3-03526 and 12.5.0-02952, which the company identified on September 1 as the fixes for two flaws it had previously reported as exploited—meaning appliances still on those builds require the new hotfix. The hotfix is available through the MySonicWall portal, installation causes the appliance to restart when finished, and SonicWall lists no workaround.

How this fits into SonicWall's 2026 SSRF pattern

This is the third time in 2026 that SonicWall has issued a fix for a 10.0-rated SSRF vulnerability in WorkPlace that requires no login. SonicWall disclosed CVE-2026-15409 and CVE-2026-15410 on July 14, and CVE-2026-83548 and CVE-2026-83549 on September 1. In its July and September advisories SonicWall said it had investigated attacks exploiting the earlier flaws—"multiple cases" in July and "a case" in September. SonicWall's staff discovered the two earlier pairs; the four new flaws were credited to outside researchers.

Researchers credited and prior exploit details

SonicWall credited Benoît Sevens of Anthropic with reporting CVE-2026-102255 and CVE-2026-102256, and Brian Mariani of DigitalCanion SA for the other two reported flaws, with one of those submitted via Trend Micro's Zero Day Initiative. For context, Rapid7 reported that in the July attacks CVE-2026-15409 allowed an attacker with no login to open a tunnel to services that respond only inside the appliance; the attacker could then run commands and use CVE-2026-15410 to gain root access to the appliance. SonicWall has not said whether the new SSRF flaw can be combined with the other three in the same way.

What this means for technologists, procurement leaders, and incident teams

  • Technologists and security teams: The hotfix release and the restart requirement are concrete changes to appliance operations—SonicWall made the hotfix available via MySonicWall and stated that installation restarts the appliance and that no workaround is listed. Security teams must match their current SMA1000 firmware against the exact affected builds named by SonicWall.
  • Procurement and enterprise IT leaders: The affected hardware is limited to SMA1000 models 6210, 7210 and 8200v; SonicWall said SSL‑VPN on SonicWall firewalls and the SMA 100 Series are not affected. That delineation will shape patch prioritization and risk assessments for mixed deployments.
  • Incident response and operations teams: SonicWall previously instructed customers—after the July and September disclosures—to check appliances for indicators of compromise and, if found, to re-image or redeploy, change user and administrator passwords, and reset TOTP tokens. SonicWall has given no comparable instruction for the four new flaws.

Five facts stand between customers and action: the CVE identifier (CVE-2026-102255), the 10.0 CVSS rating, the explicit affected models and firmware ranges, the availability of a MySonicWall hotfix that restarts the appliance, and SonicWall's statement that it currently has "no evidence that any of the four flaws is being used in attacks." Whether and how that last assertion holds up will be an immediate question for operators running the vulnerable builds.

For full details and the original advisory, see the Hacker News report: https://thehackernews.com/2026/10/sonicwall-patches-cvss-100-pre.html

Emerging ThreatsSonicwallVulnerabilityZero-DayServer-Side Request ForgerySSRFSMA1000CVE-2026-102255Pre-Auth
Related Intelligence

Continue Reading

Futuristic robotic form sits prominently in a bright server room with rows of computer workstations.

AWS Unveils Open-Source Sandbox to Tame Rogue AI Agents

AWS just launched Strands Box, an open-source sandbox that helps keep rogue AI agents in check by combining top-notch isolation with policy enforcement to prevent unchecked actions. This game-changing tool tackles the growing risk of AI agents running wild, approving every action without human review.

Analyst 207
Person sits at cluttered desk with laptop and papers, surrounded by reminders, conveying information overload and security…

Cybersecurity Pros Warn of Password Reliance

Relying on passwords for security is a recipe for disaster, as humans simply can't keep track of multiple complex combinations, leading to reused, shared, or poorly stored passwords. A recent survey found that nearly half of cybersecurity pros still use passwords for personal and work accounts, despite knowing they're one of the least secure authentication methods.

Analyst 207
Person working at desk with laptop and scattered papers, MSIX file on desk.

Microsoft Outlook to Block MSIX Attachments in Security Push

Microsoft is bolstering security in Outlook on the web and Windows by blocking MSIX attachments, including .msix and .msixbundle file types, to protect users from potential threats. This update will be applied to the default list of blocked file types, enhancing overall security in the platform.

Analyst 207
Apple research facility interior with iPhones and camera equipment on a workbench.

Apple Unveils Image Verification System to Protect Photo Integrity

Apple's new Reference Image system verifies that an image is genuine and exactly as taken by an iPhone, without revealing the photographer's identity or linking the image to a specific device. This innovative tool protects both the image and the photographer's anonymity, giving creatives peace of mind.

Analyst 207