SonicWall has released hotfixes for its SMA1000 secure remote access appliances, headlined by CVE-2026-102255, a CVSS 10.0 server-side request forgery (SSRF) in the WorkPlace portal that needs no authentication. There is no reported exploitation yet, but this is the third pre-auth WorkPlace SSRF on SMA1000 this year, and the previous two were exploited.
What happened
According to The Hacker News, SonicWall published the advisory on October 6, 2026. The SSRF comes from an unintended access path that can be reached before login. SonicWall's description, as quoted by SecurityWeek, says an unauthenticated attacker could make the appliance send requests on their behalf to:
"reach internal functionality and perform unauthorized operations"
The same release fixes three flaws that require authentication:
| CVE | Issue | Access needed | CVSS |
|---|---|---|---|
| CVE-2026-102255 | SSRF in WorkPlace portal | None (pre-auth) | 10.0 |
| CVE-2026-102256 | OS command injection leading to RCE on the appliance | Administrator | 7.8 |
| CVE-2026-102257 | Zip Slip archive extraction in the Appliance Management Console (AMC) | Authenticated user | 7.2 |
| CVE-2026-102258 | Stored XSS in the AMC | Administrator | 5.5 |
Affected models are the SMA1000 6210, 7210 and 8200v. Fixed builds are 12.4.3-03670 and 12.5.0-03082 or later. The hotfix comes from the MySonicWall portal, and the appliance restarts once it's installed. No workaround is listed. Both outlets report that SSL-VPN on SonicWall firewalls is not affected, and The Hacker News adds that the SMA 100 series isn't either. SecurityWeek quotes SonicWall as saying there is currently no evidence that any of these flaws are being exploited in the wild. The Hacker News credits Benoît Sevens (Anthropic) and Brian Mariani (DigitalCanion SA) with the findings.
Why it matters
The history makes this one urgent. The Hacker News reports that SonicWall patched CVE-2026-15409 and CVE-2026-15410 on July 14 and CVE-2026-83548 and CVE-2026-83549 on September 1. Each of those pairs combined a pre-auth WorkPlace SSRF with admin-level RCE, and each was exploited: SonicWall reported "multiple cases" for the July pair and "a case" for the September pair. The October release follows the same pattern, a pre-auth SSRF plus an admin command injection. Expect attackers who exploited the earlier pairs to study this patch quickly.
From an identity angle, an SMA1000 is the front door for remote users. It holds session state, enforces access policy, and sits in front of internal applications. A pre-auth SSRF that reaches internal functionality bypasses the authentication layer altogether. Combine it with an admin-level command injection and an attacker can end up with full control of the box that brokers your remote access.
What to check in your environment
- Inventory every SMA1000 appliance (6210, 7210, 8200v), including DR and lab units, and record the running firmware build.
- Apply the hotfix to reach 12.4.3-03670 or 12.5.0-03082 or later. Schedule a short maintenance window, because the appliance restarts and remote users will be disconnected.
- Confirm whether you patched the July and September releases. If either was missed, the appliance has been exposed to exploited bugs and needs a compromise review, not just a patch.
- Limit who can reach the AMC. Three of the four CVEs are in admin or authenticated functions. Keep the management console off the internet and restricted to admin networks (general hardening, not an advisory requirement).
- Review AMC administrator accounts and remove any you can't explain. Rotate admin credentials if the appliance ran a build affected by the earlier exploited flaws.
- Check appliance and upstream logs for unusual unauthenticated requests to WorkPlace and for unexpected outbound connections from the appliance to internal hosts, which is what SSRF abuse looks like.
- Watch SonicWall PSIRT and CISA KEV for any change to exploitation status, and assign an owner for follow-up.