SonicWall Releases Hotfixes for Critical Pre-Authentication SSRF Flaw in SMA1000 Appliances
Summary
SonicWall released hotfixes for four SMA1000 flaws, including a CVSS 10.0 SSRF vulnerability reachable without authentication. The company says it has no evidence the new flaws are being exploited.
Key points
- CVE-2026-102255 is a pre-authentication SSRF flaw in the SMA1000 WorkPlace portal, potentially allowing unauthorized access to internal functions.
- The four flaws affect SMA1000 models 6210, 7210 and 8200v; the other three require authentication.
- SonicWall rates the leading flaw CVSS 10.0 and says it has no evidence that any of the four vulnerabilities is being exploited.
- Hotfixes are available through the MySonicWall portal; installation restarts the appliance, and no workaround is listed.
- SonicWall says SSL-VPN on its firewalls and the SMA 100 Series are not affected.
- This is the third time this year SonicWall has fixed a CVSS 10.0 unauthenticated SSRF flaw in WorkPlace.
- Earlier SonicWall WorkPlace SSRF flaws were exploited in attacks; SonicWall has not said whether the new flaw can be chained with the other new vulnerabilities. The article reports no new-flaw-specific compromise-check instructions.
Article Details
- Vulnerability Types
- Server-side request forgery (SSRF)
- Severity
- CVSS 10.0 for CVE-2026-102255; severity for the other three flaws is not stated.
- Affected Versions
- SMA1000 models 6210, 7210, and 8200v on platform-hotfix versions 12.4.3-03526 and 12.5.0-02952
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2026-102255The most serious flaw, tracked as CVE-2026-102255, is a server-side request forgery (SSRF) bug in WorkPlace, the portal that SMA1000 users log in to. It exists due to an unintended access path through SonicWall and canCVE-2026-102256outside researchers for the four new flaws: Benoît Sevens of Anthropic for CVE-2026-102255 and CVE-2026-102256, and Brian Mariani of DigitalCanion SA for the other two, one of them reported through Trend Micro'sCVE-2026-15409SonicWall disclosed CVE-2026-15409 and CVE-2026-15410 on July 14, and CVE-2026-83548 and CVE-2026-83549 on September 1. Both times, it said it had investigated attacks exploiting the flaws: "multiple cases" in July andCVE-2026-15410SonicWall disclosed CVE-2026-15409 and CVE-2026-15410 on July 14, and CVE-2026-83548 and CVE-2026-83549 on September 1. Both times, it said it had investigated attacks exploiting the flaws: "multiple cases" in July andCVE-2026-83548SonicWall disclosed CVE-2026-15409 and CVE-2026-15410 on July 14, and CVE-2026-83548 and CVE-2026-83549 on September 1. Both times, it said it had investigated attacks exploiting the flaws: "multiple cases" in July andCVE-2026-83549SonicWall disclosed CVE-2026-15409 and CVE-2026-15410 on July 14, and CVE-2026-83548 and CVE-2026-83549 on September 1. Both times, it said it had investigated attacks exploiting the flaws: "multiple cases" in July and
People
Vendors
Products
Appliance Management Console (AMC)The other three flaws can be used only after logging in. Two of them are in the Appliance Management Console (AMC), where administrators configure the appliance.SMA 100 SeriesSSL-VPN on SonicWall firewalls and the SMA 100 Series are not affected.SMA1000SonicWall has released hotfixes for four flaws in its SMA1000 appliances, the gateways that give remote workers access to a company's network and applications. The most serious could allow an attacker without a login toWorkPlaceThe most serious flaw, tracked as CVE-2026-102255, is a server-side request forgery (SSRF) bug in WorkPlace, the portal that SMA1000 users log in to. It exists due to an unintended access path through SonicWall and can