SonicWall Warns of Max Severity SSRF Flaw in SMA1000 Gateways
The company said the bug lets unauthenticated attackers reach internal functions and urged customers to patch four flaws, including two that can lead to remote code execution.
- On Tuesday, SonicWall released hotfixes for a maximum-severity server-side request forgery vulnerability, CVE-2026-102255, affecting SMA1000 series appliances. The flaw allows unauthenticated remote attackers to reach internal functionality and perform unauthorized operations.
- Analyst Frank Dickson of Dickson Research explained that this SSRF vulnerability acts as a 'Trojan horse' where hostile requests arrive inside trusted ones. The flaw exploits the SMA1000's network edge role, allowing attackers to bypass authentication and manipulate internal functions remotely.
- SonicWall also revealed three additional vulnerabilities impacting SMA1000 models 6210, 7210, and 8200v, including a 7.8-rated flaw allowing admin takeover, a 7.2-rated path traversal issue, and a 5.5-rated bug that could execute arbitrary JavaScript code.
- Users who patched previous security holes remain exposed, as new hotfixes target the same software versions. Dickson advised customers to 'patch, verify the build, and ask why the same door keeps opening' to ensure complete remediation.
- Dickson warned of a troubling pattern, noting 'three 10.0 flaws in one interface in about three months is a pattern, not bad luck.' Researchers from Anthropic discovered two high-severity flaws, raising concerns that AIs will rapidly replicate these attacks.
12 Articles
12 Articles
CSO Online
Network WorldSonicWall’s latest critical flaw indicates a security pattern, not another one-off bug
SonicWall has disclosed yet another critical flaw in one of its core products. CVE-2026-102255, rated 10 in severity, the highest possible on the Common Vulnerability Scoring System (CVSS), is a pre-authentication server-side request forgery (SSRF) vulnerability in the SMA1000 Appliance Work Place interface. An unintended access path could allow attackers to order the appliance to issue requests on their behalf and gain access to internal functi…
SonicWall SMA 1000 Has a Third Pre-Auth SSRF Door, and This One Makes the Appliance Issue Requests for the Attacker
A pre-authentication vulnerability in the SonicWall SMA1000 series allows an unauthenticated request to turn the device into an unintended proxy for remote attackers. According to the SonicWall PSIRT advisory SNWLID-2026-0017, this mechanism, known as a confused deputy, permits the appliance to reach internal functionality and perform unauthorized operations without requiring any credentials. The SMA1000 line […]
SMA1000 appliances from SonicWall are designed to protect against unauthorized access to the network. However, a critical gap makes this possible.
SonicWall Fixes Max Severity Pre-Auth Flaw in SMA1000 Appliances
SonicWall Fixes Max Severity Pre-Auth Flaw in SMA1000 Appliances Pierluigi Paganini October 07, 2026 SonicWall patched a CVSS 10 pre-auth SSRF flaw in SMA1000 appliances that could let unauthenticated attackers reach internal functions. SonicWall released hotfixes for four vulnerabilities in its SMA1000 remote access appliances, including a critical flaw tracked as CVE-2026-102255 (CVSS score of
SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances
SonicWall has released hotfixes for four flaws in its SMA1000 appliances, the gateways that give remote workers access to a company's network and applications. The most serious could allow an attacker without a login to send requests through the appliance and reach internal functions. SonicWall rates it 10.0 on the CVSS scale and says it has no evidence that any of the four flaws is being
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
