SonicWall fixes pre-auth SSRF flaw in SMA 1000 appliances (CVE-2026-102255)

CVE-2026-102255 is a pre-authentication server-side request forgery flaw in the Work Place interface of SonicWall SMA1000 appliances, caused by an unintended alternate access path (CWE-441 and CWE-918). A remote unauthenticated attacker can abuse that path so the appliance issues requests on their behalf, reaching internal functionality and performing unauthorized operations. Impact is directed requests and unauthorized internal operations from the gateway, not a confirmed remote code execution outcome in the supplied description. SonicWall SMA1000 secure-access gateways that expose the Work Place interface are affected; no version range is stated in the data. There is no public proof of concept and it is not listed in CISA KEV, so exploitation is none known; CVSS is not yet scored, though vendor reporting describes it as maximum severity and a fix has been announced.

Do: Apply SonicWall’s SMA1000 firmware fix for CVE-2026-102255 as soon as it is available for your build; the supplied data does not name a fixed version. Until patched, restrict the Work Place interface to trusted management networks and watch the appliance for unexpected outbound requests or access to internal services.

A post-authentication OS command injection flaw (CWE-78) has been identified in the SonicWall SMA1000 appliance. Under specific conditions, a remote attacker who is already authenticated as an administrator can supply special elements that are not properly neutralized and are used in an operating-system command. Successful exploitation allows arbitrary OS command execution and therefore remote code execution on the appliance. Organizations running SMA1000 secure remote-access appliances are affected; exact version ranges are not stated in the supplied data. No public proof of concept is known and the issue is not in CISA KEV, so exploitation is currently none known.

Do: Apply the SonicWall PSIRT update for CVE-2026-102256 to every SMA1000 appliance as soon as the vendor package for your build is available; the supplied data does not name a fixed version. Until then, limit administrator access to trusted management networks, use strong admin credentials and MFA where supported, and review admin audit logs for unexpected command or configuration activity. Track this issue separately from the related pre-auth SSRF flaw CVE-2026-102255.

A post-authentication stored cross-site scripting flaw (CWE-79) exists in the SonicWall SMA 1000 Appliance Management Console (AMC). Under specific conditions, a remote attacker who is already authenticated as an administrator can store arbitrary JavaScript in the console so that it may later run in the AMC when that content is rendered. The practical impact is limited to the management-console context, such as executing script in another administrator’s session, rather than unauthenticated takeover of the appliance. SonicWall SMA 1000 appliances that use the AMC are affected; the advisory data does not list firmware versions, CVSS is not yet scored, and no public proof-of-concept is known. The issue is not in CISA KEV, so exploitation is none known, and it is distinct from the pre-authentication SSRF tracked as CVE-2026-102255.

Do: Apply the SonicWall PSIRT fix for CVE-2026-102258 on SMA 1000 as soon as it is available for your build; the supplied data does not name a fixed version. Keep the Appliance Management Console off the internet and limited to trusted administrator networks, and review admin accounts and stored console content for unexpected script.

CVE-2026-15409 is a server-side request forgery (SSRF, CWE-918) in the Appliance Work Place interface of SonicWall SMA1000 series appliances. A remote, unauthenticated attacker can trigger the flaw over the network, causing the appliance to issue requests to attacker-influenced or unintended internal locations. Because the CVSS vector scores scope-changed impacts on confidentiality, integrity, and availability, the SSRF is assessed as capable of reaching sensitive internal services, and reporting indicates it is being used alongside a second SMA1000 zero-day in what may be an exploitation chain. Affected organizations are those running SMA1000 appliances, including SMA 6210, SMA 7210, and SMA 8200v models, which typically act as internet-facing remote-access/VPN gateways. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2026-07-14, ransomware use is known, and EPSS assigns an 83.7% probability of exploitation within 30 days, though no public PoC is available.

Do: Apply SonicWall's SMA1000 firmware update per the vendor's instructions immediately, prioritizing appliances with the Appliance Work Place interface reachable from the internet. Because the flaw is in CISA's KEV with known ransomware use and may be chained with a second SMA1000 zero-day, hunt for signs of compromise (unexpected outbound or internal requests, anomalous VPN sessions, follow-on ransomware activity) and restrict internet exposure of the interface in the interim. Federal and critical-infrastructure operators must comply with CISA BOD 26-04, including cloud-service guidance, or discontinue use if mitigations are unavailable.

CVE-2026-83548 is a critical (CVSS 3.1 score 10.0) server-side request forgery (SSRF) vulnerability in the Workplace interface of SonicWall SMA1000 appliances, caused by an unintended alternate access path (unprotected alternate channel, CWE-441; SSRF, CWE-918). Because it is pre-authentication, any remote unauthenticated attacker who can reach the interface can trigger it and gain unauthorized access to sensitive functionality and perform unauthorized operations. CISA lists all SonicWall SMA1000 appliances as affected, with CPE data naming the SMA 8200v and SMA 6210/7210 firmware; internet-exposed units are at highest risk. The flaw is being actively exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-02 alongside companion zero-day CVE-2026-83549, which reporting suggests may form an attack chain with this SSRF. Exploitation probability is elevated (EPSS 4.7%, 91st percentile) and no public proof-of-concept is known.

Do: Apply the fixes/mitigations from SonicWall security advisory AV26-872 (Update 1) immediately, prioritizing internet-exposed SMA 1000 appliances, and treat companion zero-day CVE-2026-83549 as requiring remediation in the same maintenance window. Review SMA 1000 logs for signs of exploitation (unexpected access to or requests against the Workplace interface) and reduce internet exposure of that interface where feasible. Per the CISA KEV required action and BOD 26-04, patch per vendor instructions or, where mitigations are unavailable, evaluate each asset's internet exposure and discontinue use of the product until remediated.