SonicWall has released security hotfixes to address four security vulnerabilities in its enterprise SMA1000 series remote-access appliances, including a maximum-severity flaw rated 10.0 on the CVSS scale. The bug allows unauthenticated remote users to send requests through the portal to access internal system functions without credentials.
Critical Portal Flaw
Tracked as CVE-2026-102255, the primary vulnerability is a server-side request forgery (SSRF) flaw in WorkPlace, the user portal for SMA1000 appliances. According to SonicWall's advisory, an unintended path allows an attacker to perform unauthorized operations on internal functionality prior to authentication. Security researcher Benoît Sevens of Anthropic reported CVE-2026-102255 along with CVE-2026-102256, while Brian Mariani of DigitalCanion SA identified the remaining two post-authentication flaws.
Affected Models and Update Path
The vulnerabilities impact SMA1000 models 6210, 7210, and 8200v running firmware versions 12.4.3-03526 or older, as well as 12.5.0-02952 or older. Appliances patched with SonicWall's September 1 update remain vulnerable and require the new hotfix. System administrators must upgrade to firmware version 12.4.3-03670 or 12.5.0-03082 to remediate the issues. The patches are distributed through the MySonicWall portal and force an immediate device reboot upon installation, with no workarounds available.
Recurring Gateway Risks
This release marks the third time in 2026 that SonicWall has patched a 10.0-rated unauthenticated SSRF flaw in the WorkPlace portal of SMA1000 appliances, following previous disclosures in July and September. SonicWall stated it has found no evidence that the four newly disclosed vulnerabilities have been exploited in active attacks. The company also confirmed that SSL-VPN capabilities on SonicWall firewalls and the SMA 100 Series are not affected by these vulnerabilities.
AI-generated editorial illustration; not a documentary photograph.
Source: SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances
SIGNAL TITANS
Leave a Reply