SonicWall Fixes Max Severity Pre-Auth Flaw in SMA1000 Appliances

CVE-2026-102255 is a pre-authentication server-side request forgery flaw in the Work Place interface of SonicWall SMA1000 appliances, caused by an unintended alternate access path (CWE-441 and CWE-918). A remote unauthenticated attacker can abuse that path so the appliance issues requests on their behalf, reaching internal functionality and performing unauthorized operations. Impact is directed requests and unauthorized internal operations from the gateway, not a confirmed remote code execution outcome in the supplied description. SonicWall SMA1000 secure-access gateways that expose the Work Place interface are affected; no version range is stated in the data. There is no public proof of concept and it is not listed in CISA KEV, so exploitation is none known; CVSS is not yet scored, though vendor reporting describes it as maximum severity and a fix has been announced.

Do: Apply SonicWall’s SMA1000 firmware fix for CVE-2026-102255 as soon as it is available for your build; the supplied data does not name a fixed version. Until patched, restrict the Work Place interface to trusted management networks and watch the appliance for unexpected outbound requests or access to internal services.

A post-authentication OS command injection flaw (CWE-78) has been identified in the SonicWall SMA1000 appliance. Under specific conditions, a remote attacker who is already authenticated as an administrator can supply special elements that are not properly neutralized and are used in an operating-system command. Successful exploitation allows arbitrary OS command execution and therefore remote code execution on the appliance. Organizations running SMA1000 secure remote-access appliances are affected; exact version ranges are not stated in the supplied data. No public proof of concept is known and the issue is not in CISA KEV, so exploitation is currently none known.

Do: Apply the SonicWall PSIRT update for CVE-2026-102256 to every SMA1000 appliance as soon as the vendor package for your build is available; the supplied data does not name a fixed version. Until then, limit administrator access to trusted management networks, use strong admin credentials and MFA where supported, and review admin audit logs for unexpected command or configuration activity. Track this issue separately from the related pre-auth SSRF flaw CVE-2026-102255.

A post-authentication stored cross-site scripting flaw (CWE-79) exists in the SonicWall SMA 1000 Appliance Management Console (AMC). Under specific conditions, a remote attacker who is already authenticated as an administrator can store arbitrary JavaScript in the console so that it may later run in the AMC when that content is rendered. The practical impact is limited to the management-console context, such as executing script in another administrator’s session, rather than unauthenticated takeover of the appliance. SonicWall SMA 1000 appliances that use the AMC are affected; the advisory data does not list firmware versions, CVSS is not yet scored, and no public proof-of-concept is known. The issue is not in CISA KEV, so exploitation is none known, and it is distinct from the pre-authentication SSRF tracked as CVE-2026-102255.

Do: Apply the SonicWall PSIRT fix for CVE-2026-102258 on SMA 1000 as soon as it is available for your build; the supplied data does not name a fixed version. Keep the Appliance Management Console off the internet and limited to trusted administrator networks, and review admin accounts and stored console content for unexpected script.

CVE-2026-83548 is a critical (CVSS 3.1 score 10.0) server-side request forgery (SSRF) vulnerability in the Workplace interface of SonicWall SMA1000 appliances, caused by an unintended alternate access path (unprotected alternate channel, CWE-441; SSRF, CWE-918). Because it is pre-authentication, any remote unauthenticated attacker who can reach the interface can trigger it and gain unauthorized access to sensitive functionality and perform unauthorized operations. CISA lists all SonicWall SMA1000 appliances as affected, with CPE data naming the SMA 8200v and SMA 6210/7210 firmware; internet-exposed units are at highest risk. The flaw is being actively exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-02 alongside companion zero-day CVE-2026-83549, which reporting suggests may form an attack chain with this SSRF. Exploitation probability is elevated (EPSS 4.7%, 91st percentile) and no public proof-of-concept is known.

Do: Apply the fixes/mitigations from SonicWall security advisory AV26-872 (Update 1) immediately, prioritizing internet-exposed SMA 1000 appliances, and treat companion zero-day CVE-2026-83549 as requiring remediation in the same maintenance window. Review SMA 1000 logs for signs of exploitation (unexpected access to or requests against the Workplace interface) and reduce internet exposure of that interface where feasible. Per the CISA KEV required action and BOD 26-04, patch per vendor instructions or, where mitigations are unavailable, evaluate each asset's internet exposure and discontinue use of the product until remediated.