SMA1000 (Product): news timeline & CVEs

SonicWall and Splunk Patch Critical Vulnerabilities

SonicWall patched a CVSS 10 pre-auth SSRF in SMA1000, and Splunk fixed critical command-execution flaws.

SonicWall patched four SMA1000 flaws, led by CVE-2026-102255, a CVSS 10 pre-authenticated SSRF that could let remote attackers reach internal functionality. The updates also cover remote code execution and XSS issues; SonicWall said there is no evidence of exploitation and that firewall SSL-VPN is unaffected. Splunk fixed dozens of bugs in Splunk Enterprise, MCP Server, and the Add-on for Amazon Web Services, including three critical Enterprise flaws enabling command execution, unauthorized access, and code injection.

SecurityWeekOct 8, 12:37 UTC · 11h agoVulnerability 6 sources CVE-2026-1022551

SonicWall’s latest critical flaw indicates a security pattern, not another one-off bug

SonicWall disclosed a CVSS 10 pre-auth SSRF in SMA1000, with no confirmed exploitation yet.

SonicWall disclosed CVE-2026-102255, a CVSS 10 pre-authentication SSRF in the SMA1000 Work Place interface on models 6210, 7210, and 8200v running 12.4.3-03526 and 12.5.0-02952 and earlier. It also disclosed CVE-2026-102256 (CVSS 7.8), CVE-2026-102257 (7.2), and CVE-2026-102258 (5.5). SonicWall said there is no evidence the critical flaw is exploited and advised upgrades to 12.4.3-03670 or 12.5.0-03082, which are the only fixes. Earlier SMA1000 bugs, including CVE-2026-83548, CVE-2026-83549, and zero-day CVE-2026-15409, were actively exploited, and CISA has listed 19 SonicWall flaws as exploited over four years.

CSO OnlineOct 8, 03:19 UTC · 21h agoVulnerability CVE-2026-102255 CVE-2026-102256 CVE-2026-102257+4 CVEs2

SonicWall security advisory (AV26-1017)

Canada's Cyber Centre warns SonicWall SMA1000 appliances through version 12.5.0 have multiple vulnerabilities and should be updated.

The Canadian Centre for Cyber Security published advisory AV26-1017 on October 7, 2026, warning that SonicWall SMA1000 models 6210, 7210, and 8200v are affected by multiple vulnerabilities. Impacted builds are version 12.4.3-03670 (platform-hotfix) and earlier, and version 12.5.0-03082 (platform-hotfix) and earlier. The centre urges administrators to review SonicWall's advisory and apply updates when available. The alert does not list CVE identifiers or say the flaws are being exploited.

Canadian Centre for Cyber Securityupdated Oct 8, 12:37 UTC · 11h agofirst Oct 7, 19:07 UTC · 1d agoAdvisory 6 sources1

SonicWall Fixes Max Severity Pre-Auth Flaw in SMA1000 Appliances

SonicWall patched a CVSS 10 pre-auth SSRF in SMA1000 appliances, with no evidence of exploitation.

SonicWall released hotfixes for four SMA1000 flaws, led by CVE-2026-102255, a CVSS 10.0 pre-authentication SSRF in the WorkPlace interface that could let an unauthenticated attacker make the appliance reach internal functions. Affected builds are SMA1000 models 6210, 7210, and 8200v at 12.4.3-03526 and 12.5.0-02952 platform-hotfixes and older; there is no workaround. Authenticated issues include OS command injection CVE-2026-102256 (CVSS 7.8), Zip Slip CVE-2026-102257 (CVSS 7.2), and stored XSS CVE-2026-102258 (CVSS 5.5). SonicWall said it has no evidence these new bugs are exploited, unlike September SMA1000 zero-days CVE-2026-83548 and CVE-2026-83549.

Security Affairsupdated Oct 8, 12:37 UTC · 11h agofirst Oct 7, 18:17 UTC · 1d agoVulnerability 6 sources CVE-2026-102255 CVE-2026-102256 CVE-2026-102257

SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances

SonicWall patched a CVSS 10.0 pre-auth SSRF in SMA1000 WorkPlace plus three authenticated flaws.

SonicWall released hotfixes for four flaws in SMA1000 models 6210, 7210, and 8200v on platform versions 12.4.3 and 12.5.0. CVE-2026-102255 is a pre-authentication server-side request forgery in the WorkPlace portal, rated CVSS 10.0, that could let an unauthenticated attacker reach internal functions. The other issues require login: OS command injection CVE-2026-102256 (CVSS 7.8), Zip Slip CVE-2026-102257 (7.2), and stored XSS CVE-2026-102258 (5.5). SonicWall says it has no evidence any of the four is being exploited. SSL-VPN and the SMA 100 Series are not affected; fixed versions are 12.4.3-03670 and 12.5.0-03082 or higher.

The Hacker NewsOct 7, 16:17 UTC · 1d agoVulnerability CVE-2026-102255 CVE-2026-102256 CVE-2026-102257+5 CVEs2· 1 read

SonicWall warns of max severity SSRF flaw in SMA1000 gateways

SonicWall patches maximum-severity unauthenticated SSRF CVE-2026-102255 in SMA1000 gateways; no exploitation reported.

SonicWall released hotfixes for CVE-2026-102255, a maximum-severity server-side request forgery flaw in the WorkPlace interface of SMA1000 models 6210, 7210, and 8200v. A remote unauthenticated attacker could make the appliance issue requests and reach internal functionality; the SMA 100 Series and firewall SSL-VPN are unaffected. SonicWall said there is no evidence this flaw is being exploited in the wild. Shadowserver tracks more than 400 internet-exposed SMA1000 appliances, and prior SMA1000 zero-days, including CVE-2026-15409 and CVE-2026-15410, were previously used in ransomware-linked attacks.

BleepingComputerupdated Oct 8, 12:37 UTC · 11h agofirst Oct 7, 11:37 UTC · 1d agoVulnerability 6 sources CVE-2026-102255 CVE-2026-15409 CVE-2026-15410

Hackers Chain Two New SonicWall Zero-Day Vulnerabilities

SonicWall warns two zero-days (CVE-2026-83548 SSRF, CVE-2026-83549 post-auth RCE) in SMA1000 appliances are being actively exploited.

A September 1 SonicWall advisory discloses actively exploited zero-days in SMA1000 appliance models 6210, 7210 and 8200v, affecting platform-hotfix versions 12.4.3-03453 and 12.5.0-02835 and older. CVE-2026-83548 (CVSS 10.0) is a pre-authentication SSRF in the Appliance Work Place interface via an unintended alternate access path; CVE-2026-83549 (CVSS 7.8) is post-authentication OS command injection enabling RCE in the Appliance Management Console. SonicWall urges hotfix upgrades, IOC checks with SonicWall support, and re-imaging plus credential and TOTP resets if compromise is found.

Infosecurity MagazineSep 2, 09:00 UTC · Sep 2, 2026Exploit / PoC in the wildCVE-2026-83548 CVE-2026-83549

SMA1000

Timeline7 articles

Related CVEsby mentions

Appears with