Story · 6 sources · 6 articlesfirst Oct 7, 10:37 UTCupdated Oct 8, 12:37 UTC (12h ago)

SonicWall patches CVSS 10 SMA 1000 SSRF; Splunk fixes bugs

highVulnerabilityimportance 76CVE-2026-102255 CVE-2026-15409 CVE-2026-15410 CVE-2026-83548 CVE-2026-83549 CVE-2026-102256 CVE-2026-102257 CVE-2026-102258

What's new: SecurityWeek’s October 8 report adds that Splunk patched dozens of bugs in Splunk Enterprise, MCP Server, and the AWS add-on, including three critical Enterprise flaws and an authenticated API-redirect issue, while restating the SonicWall fixes and no known exploitation.

Merged summary · grok-4.7 · rewritten as coverage arrives

SonicWall patched CVSS 10 pre-auth SSRF CVE-2026-102255 and three other SMA 1000 flaws, with no known exploitation; Splunk also fixed critical bugs.

SonicWall advisory SNWLID-2026-0017, published October 6, 2026, patches four flaws in SMA 1000 physical and virtual models 6210, 7210, and 8200v. CVE-2026-102255 is a pre-authentication SSRF in the WorkPlace interface, rated CVSS 10.0 and maximum severity, that could let a remote unauthenticated attacker request internal endpoints, reach internal functionality, or use the appliance as an unintended forward proxy. Companion issues are authenticated OS command injection CVE-2026-102256 (CVSS 7.8) and stored or administrator-only XSS CVE-2026-102258 (CVSS 5.5); sources disagree on CVE-2026-102257, which Help Net Security calls administrator-only path traversal while Cyber Security News and Security Affairs describe a management-console Zip Slip scored 7.2 that can lead to remote code execution. SonicWall reports no known exploitation and no workaround and advises 12.4.3-03670 or 12.5.0-03082 and later for 12.4.3-03526 and 12.5.0-02952 and older, but Canadian Centre for Cyber Security advisory AV26-1017 lists those hotfix versions and earlier as still impacted and cites no CVEs. The SMA 100 series is unaffected, and firewall SSL-VPN products are unaffected according to BleepingComputer, Cyber Security News, and Security Affairs, while Help Net Security says firewalls are unaffected; Shadowserver tracks more than 400 internet-exposed SMA1000 appliances, prior zero-days CVE-2026-15409 and CVE-2026-15410 were linked to ransomware attacks, and September fixes for CVE-2026-83548 and CVE-2026-83549 do not resolve the new bugs. SecurityWeek on October 8 also reported that Splunk fixed dozens of bugs in Splunk Enterprise, MCP Server, and the Add-on for Amazon Web Services, including three critical Enterprise flaws enabling command execution, unauthorized access, and code injection, plus an MCP Server patch stopping authenticated users from redirecting API requests to attacker URLs.

CVE-2026-102255 is a pre-authentication SSRF in the SMA 1000 WorkPlace interface on models 6210, 7210, and 8200v, rated CVSS 10.0.
Also patched: authenticated command injection CVE-2026-102256 (CVSS 7.8) and XSS CVE-2026-102258 (CVSS 5.5); sources disagree on CVE-2026-102257 (admin path traversal vs. Zip Slip, CVSS 7.2, possible RCE).
Vendor fixes are 12.4.3-03670 or 12.5.0-03082 and later; Canada’s AV26-1017 (Oct. 7, 2026) lists those builds and earlier as affected and names no CVEs.
SonicWall reports no known exploitation and no workaround; SMA 100 series and firewall SSL-VPN products are unaffected.

VendorsSonicWall Splunk

ProductsSMA1000 SMA 100 Series SMA 1000 Secure Mobile Access Splunk Enterprise Splunk MCP Server Splunk Add-on for Amazon Web Services SMA 6210 SMA 7210 SMA 8200v WorkPlace Appliance Management Console

MalwareSou5 OrangeTail RootRun

OrganizationsCISA Shadowserver SonicWall Anthropic Trend Micro

Coverage timelineoldest first · each row is one article

Oct 7, 10:37 UTC · 1d ago
Help Net Security· 70
SonicWall fixes pre-auth SSRF flaw in SMA 1000 appliances (CVE-2026-102255)
SonicWall patched pre-auth SSRF CVE-2026-102255 in SMA 1000 appliances, with no known exploitation.
Oct 7, 11:37 UTC · 1d ago
BleepingComputer· 76
SonicWall warns of max severity SSRF flaw in SMA1000 gateways
SonicWall patches maximum-severity unauthenticated SSRF CVE-2026-102255 in SMA1000 gateways; no exploitation reported.
Oct 7, 14:27 UTC · 1d ago
Cyber Security News· 68
SonicWall Patches 4 SMA1000 Flaws, Including Critical Pre-Auth SSRF Rated CVSS 10

Vulnerabilities in this storyAll →

CVE-2026-10225510.0—
Pre-auth SSRF in SonicWall SMA1000 Work Place interface
published 1d ago· SonicWall SMA1000 Appliance (Work Place interface)+1 related
CVE-2026-1022567.8—
Authenticated OS command injection in SonicWall SMA1000
published 1d ago· SonicWall SMA1000

CVE	Vulnerability	CVSS	EPSS	Affected	Exposure	Published
CVE-2026-102255 +1 related CVE CVE-2026-102257	Pre-auth SSRF in SonicWall SMA1000 Work Place interface CVE-2026-102255 is a pre-authentication server-side request forgery flaw in the Work Place interface of SonicWall SMA1000 appliances, caused by an unintended alternate access path (CWE-441 and CWE-918). A remote unauthenticated attacker can abuse that path so the appliance issues requests on their behalf, reaching internal functionality and performing unauthorized operations. Impact is directed requests and unauthorized internal operations from the gateway, not a confirmed remote code execution outcome in the supplied description. SonicWall SMA1000 secure-access gateways that expose the Work Place interface are affected; no version range is stated in the data. There is no public proof of concept and it is not listed in CISA KEV, so exploitation is none known; CVSS is not yet scored, though vendor reporting describes it as maximum severity and a fix has been announced. Do: Apply SonicWall’s SMA1000 firmware fix for CVE-2026-102255 as soon as it is available for your build; the supplied data does not name a fixed version. Until patched, restrict the Work Place interface to trusted management networks and watch the appliance for unexpected outbound requests or access to internal services.	10.0 group max	—	SonicWall SMA1000 Appliance (Work Place interface)	moderate≈1,000–10,000 internet-exposed appliances (estimate)	1d ago
CVE-2026-102256	Authenticated OS command injection in SonicWall SMA1000 A post-authentication OS command injection flaw (CWE-78) has been identified in the SonicWall SMA1000 appliance. Under specific conditions, a remote attacker who is already authenticated as an administrator can supply special elements that are not properly neutralized and are used in an operating-system command. Successful exploitation allows arbitrary OS command execution and therefore remote code execution on the appliance. Organizations running SMA1000 secure remote-access appliances are affected; exact version ranges are not stated in the supplied data. No public proof of concept is known and the issue is not in CISA KEV, so exploitation is currently none known. Do: Apply the SonicWall PSIRT update for CVE-2026-102256 to every SMA1000 appliance as soon as the vendor package for your build is available; the supplied data does not name a fixed version. Until then, limit administrator access to trusted management networks, use strong admin credentials and MFA where supported, and review admin audit logs for unexpected command or configuration activity. Track this issue separately from the related pre-auth SSRF flaw CVE-2026-102255.	7.8	—	SonicWall SMA1000	moderateOn the order of 1,000–10,000 appliances (estimate)	1d ago
CVE-2026-102258	Stored XSS in SonicWall SMA 1000 Management Console A post-authentication stored cross-site scripting flaw (CWE-79) exists in the SonicWall SMA 1000 Appliance Management Console (AMC). Under specific conditions, a remote attacker who is already authenticated as an administrator can store arbitrary JavaScript in the console so that it may later run in the AMC when that content is rendered. The practical impact is limited to the management-console context, such as executing script in another administrator’s session, rather than unauthenticated takeover of the appliance. SonicWall SMA 1000 appliances that use the AMC are affected; the advisory data does not list firmware versions, CVSS is not yet scored, and no public proof-of-concept is known. The issue is not in CISA KEV, so exploitation is none known, and it is distinct from the pre-authentication SSRF tracked as CVE-2026-102255. Do: Apply the SonicWall PSIRT fix for CVE-2026-102258 on SMA 1000 as soon as it is available for your build; the supplied data does not name a fixed version. Keep the Appliance Management Console off the internet and limited to trusted administrator networks, and review admin accounts and stored console content for unexpected script.	6.1	—	SonicWall SMA 1000 Appliance Management Console (AMC)	nicheLow thousands of enterprise appliances (order-of-magnitude estimate, not a measured count)	1d ago
CVE-2026-15409 +1 related CVE CVE-2026-15410	Unauthenticated SSRF in SonicWall SMA1000 Appliances CVE-2026-15409 is a server-side request forgery (SSRF, CWE-918) in the Appliance Work Place interface of SonicWall SMA1000 series appliances. A remote, unauthenticated attacker can trigger the flaw over the network, causing the appliance to issue requests to attacker-influenced or unintended internal locations. Because the CVSS vector scores scope-changed impacts on confidentiality, integrity, and availability, the SSRF is assessed as capable of reaching sensitive internal services, and reporting indicates it is being used alongside a second SMA1000 zero-day in what may be an exploitation chain. Affected organizations are those running SMA1000 appliances, including SMA 6210, SMA 7210, and SMA 8200v models, which typically act as internet-facing remote-access/VPN gateways. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2026-07-14, ransomware use is known, and EPSS assigns an 83.7% probability of exploitation within 30 days, though no public PoC is available. Do: Apply SonicWall's SMA1000 firmware update per the vendor's instructions immediately, prioritizing appliances with the Appliance Work Place interface reachable from the internet. Because the flaw is in CISA's KEV with known ransomware use and may be chained with a second SMA1000 zero-day, hunt for signs of compromise (unexpected outbound or internal requests, anomalous VPN sessions, follow-on ransomware activity) and restrict internet exposure of the interface in the interim. Federal and critical-infrastructure operators must comply with CISA BOD 26-04, including cloud-service guidance, or discontinue use if mitigations are unavailable.	10.0 group max	7%
CVE-2026-83548 +1 related CVE CVE-2026-83549	Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface CVE-2026-83548 is a critical (CVSS 3.1 score 10.0) server-side request forgery (SSRF) vulnerability in the Workplace interface of SonicWall SMA1000 appliances, caused by an unintended alternate access path (unprotected alternate channel, CWE-441; SSRF, CWE-918). Because it is pre-authentication, any remote unauthenticated attacker who can reach the interface can trigger it and gain unauthorized access to sensitive functionality and perform unauthorized operations. CISA lists all SonicWall SMA1000 appliances as affected, with CPE data naming the SMA 8200v and SMA 6210/7210 firmware; internet-exposed units are at highest risk. The flaw is being actively exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-02 alongside companion zero-day CVE-2026-83549, which reporting suggests may form an attack chain with this SSRF. Exploitation probability is elevated (EPSS 4.7%, 91st percentile) and no public proof-of-concept is known. Do: Apply the fixes/mitigations from SonicWall security advisory AV26-872 (Update 1) immediately, prioritizing internet-exposed SMA 1000 appliances, and treat companion zero-day CVE-2026-83549 as requiring remediation in the same maintenance window. Review SMA 1000 logs for signs of exploitation (unexpected access to or requests against the Workplace interface) and reduce internet exposure of that interface where feasible. Per the CISA KEV required action and BOD 26-04, patch per vendor instructions or, where mitigations are unavailable, evaluate each asset's internet exposure and discontinue use of the product until remediated.	10.0 group max	9%

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-102255

+1 related CVE

CVE-2026-102257

Pre-auth SSRF in SonicWall SMA1000 Work Place interface

CVE-2026-102255 is a pre-authentication server-side request forgery flaw in the Work Place interface of SonicWall SMA1000 appliances, caused by an unintended alternate access path (CWE-441 and CWE-918). A remote unauthenticated attacker can abuse that path so the appliance issues requests on their behalf, reaching internal functionality and performing unauthorized operations. Impact is directed requests and unauthorized internal operations from the gateway, not a confirmed remote code execution outcome in the supplied description. SonicWall SMA1000 secure-access gateways that expose the Work Place interface are affected; no version range is stated in the data. There is no public proof of concept and it is not listed in CISA KEV, so exploitation is none known; CVSS is not yet scored, though vendor reporting describes it as maximum severity and a fix has been announced.

Do: Apply SonicWall’s SMA1000 firmware fix for CVE-2026-102255 as soon as it is available for your build; the supplied data does not name a fixed version. Until patched, restrict the Work Place interface to trusted management networks and watch the appliance for unexpected outbound requests or access to internal services.

10.0

group max

—

SonicWall SMA1000 Appliance (Work Place interface)

moderate≈1,000–10,000 internet-exposed appliances (estimate)

1d ago

CVE-2026-102256

Authenticated OS command injection in SonicWall SMA1000

A post-authentication OS command injection flaw (CWE-78) has been identified in the SonicWall SMA1000 appliance. Under specific conditions, a remote attacker who is already authenticated as an administrator can supply special elements that are not properly neutralized and are used in an operating-system command. Successful exploitation allows arbitrary OS command execution and therefore remote code execution on the appliance. Organizations running SMA1000 secure remote-access appliances are affected; exact version ranges are not stated in the supplied data. No public proof of concept is known and the issue is not in CISA KEV, so exploitation is currently none known.

Do: Apply the SonicWall PSIRT update for CVE-2026-102256 to every SMA1000 appliance as soon as the vendor package for your build is available; the supplied data does not name a fixed version. Until then, limit administrator access to trusted management networks, use strong admin credentials and MFA where supported, and review admin audit logs for unexpected command or configuration activity. Track this issue separately from the related pre-auth SSRF flaw CVE-2026-102255.

7.8

—

SonicWall SMA1000

moderateOn the order of 1,000–10,000 appliances (estimate)

1d ago

CVE-2026-102258

Stored XSS in SonicWall SMA 1000 Management Console

A post-authentication stored cross-site scripting flaw (CWE-79) exists in the SonicWall SMA 1000 Appliance Management Console (AMC). Under specific conditions, a remote attacker who is already authenticated as an administrator can store arbitrary JavaScript in the console so that it may later run in the AMC when that content is rendered. The practical impact is limited to the management-console context, such as executing script in another administrator’s session, rather than unauthenticated takeover of the appliance. SonicWall SMA 1000 appliances that use the AMC are affected; the advisory data does not list firmware versions, CVSS is not yet scored, and no public proof-of-concept is known. The issue is not in CISA KEV, so exploitation is none known, and it is distinct from the pre-authentication SSRF tracked as CVE-2026-102255.

Do: Apply the SonicWall PSIRT fix for CVE-2026-102258 on SMA 1000 as soon as it is available for your build; the supplied data does not name a fixed version. Keep the Appliance Management Console off the internet and limited to trusted administrator networks, and review admin accounts and stored console content for unexpected script.

6.1

—

SonicWall SMA 1000 Appliance Management Console (AMC)

nicheLow thousands of enterprise appliances (order-of-magnitude estimate, not a measured count)

1d ago

CVE-2026-15409

+1 related CVE

CVE-2026-15410

Unauthenticated SSRF in SonicWall SMA1000 Appliances

CVE-2026-15409 is a server-side request forgery (SSRF, CWE-918) in the Appliance Work Place interface of SonicWall SMA1000 series appliances. A remote, unauthenticated attacker can trigger the flaw over the network, causing the appliance to issue requests to attacker-influenced or unintended internal locations. Because the CVSS vector scores scope-changed impacts on confidentiality, integrity, and availability, the SSRF is assessed as capable of reaching sensitive internal services, and reporting indicates it is being used alongside a second SMA1000 zero-day in what may be an exploitation chain. Affected organizations are those running SMA1000 appliances, including SMA 6210, SMA 7210, and SMA 8200v models, which typically act as internet-facing remote-access/VPN gateways. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2026-07-14, ransomware use is known, and EPSS assigns an 83.7% probability of exploitation within 30 days, though no public PoC is available.

Do: Apply SonicWall's SMA1000 firmware update per the vendor's instructions immediately, prioritizing appliances with the Appliance Work Place interface reachable from the internet. Because the flaw is in CISA's KEV with known ransomware use and may be chained with a second SMA1000 zero-day, hunt for signs of compromise (unexpected outbound or internal requests, anomalous VPN sessions, follow-on ransomware activity) and restrict internet exposure of the interface in the interim. Federal and critical-infrastructure operators must comply with CISA BOD 26-04, including cloud-service guidance, or discontinue use if mitigations are unavailable.

10.0

group max

CVE-2026-83548

+1 related CVE

CVE-2026-83549

Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface

CVE-2026-83548 is a critical (CVSS 3.1 score 10.0) server-side request forgery (SSRF) vulnerability in the Workplace interface of SonicWall SMA1000 appliances, caused by an unintended alternate access path (unprotected alternate channel, CWE-441; SSRF, CWE-918). Because it is pre-authentication, any remote unauthenticated attacker who can reach the interface can trigger it and gain unauthorized access to sensitive functionality and perform unauthorized operations. CISA lists all SonicWall SMA1000 appliances as affected, with CPE data naming the SMA 8200v and SMA 6210/7210 firmware; internet-exposed units are at highest risk. The flaw is being actively exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-02 alongside companion zero-day CVE-2026-83549, which reporting suggests may form an attack chain with this SSRF. Exploitation probability is elevated (EPSS 4.7%, 91st percentile) and no public proof-of-concept is known.

Do: Apply the fixes/mitigations from SonicWall security advisory AV26-872 (Update 1) immediately, prioritizing internet-exposed SMA 1000 appliances, and treat companion zero-day CVE-2026-83549 as requiring remediation in the same maintenance window. Review SMA 1000 logs for signs of exploitation (unexpected access to or requests against the Workplace interface) and reduce internet exposure of that interface where feasible. Per the CISA KEV required action and BOD 26-04, patch per vendor instructions or, where mitigations are unavailable, evaluate each asset's internet exposure and discontinue use of the product until remediated.

10.0

group max