CVE-2026-102256

A post-authentication OS command injection flaw (CWE-78) has been identified in the SonicWall SMA1000 appliance. Under specific conditions, a remote attacker who is already authenticated as an administrator can supply special elements that are not properly neutralized and are used in an operating-system command. Successful exploitation allows arbitrary OS command execution and therefore remote code execution on the appliance. Organizations running SMA1000 secure remote-access appliances are affected; exact version ranges are not stated in the supplied data. No public proof of concept is known and the issue is not in CISA KEV, so exploitation is currently none known.

What to do: Apply the SonicWall PSIRT update for CVE-2026-102256 to every SMA1000 appliance as soon as the vendor package for your build is available; the supplied data does not name a fixed version. Until then, limit administrator access to trusted management networks, use strong admin credentials and MFA where supported, and review admin audit logs for unexpected command or configuration activity. Track this issue separately from the related pre-auth SSRF flaw CVE-2026-102255.