SonicWall Releases Critical Security Advisory for SMA1000 Series Appliances

Security updates address four vulnerabilities, including a maximum severity unauthenticated SSRF vulnerability

Threat ID:: CC-4863
Threat Severity:: Medium
Published:: 8 October 2026 2:53 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Security updates address four vulnerabilities, including a maximum severity unauthenticated SSRF vulnerability

Affected platforms

The following platforms are known to be affected:

SonicWall Secure Mobile Access (SMA) 1000 Series

Models 6210, 7210, and 8200v running:

12.4.3-03526 (platform-hotfix) and older versions
12.5.0-02952 (platform-hotfix) and older versions.

Note: These vulnerabilities do not affect SSL-VPN running on SonicWall firewalls or the SMA 100 Series product line.

Threat details

Introduction

SonicWall has released a security advisory to address multiple vulnerabilities in SMA1000 Series Appliances.

CVE-2026-102255 - 'Server-Side Request Forgery (SSRF)' vulnerability - CVSSv3 score: 10.0.
CVE-2026-102256 - 'OS Command Injection' vulnerability - CVSSv3 score: 7.8.
CVE-2026-102257 - 'Path Traversal' vulnerability - CVSSv3 score: 7.2.
CVE-2026-102258 - 'Cross-Site Scripting' vulnerability - CVSSv3 score: 5.5.

Remediation advice

Affected organisations are encouraged to review SonicWall's security advisory SNWLID-2026-0017 and apply the relevant updates as soon as possible.

Definitive source of threat updates

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017

CVE Vulnerabilities

Status Published

CVE-2026-102255

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.

Status Published

CVE-2026-102256

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.

Status Published

CVE-2026-102257

A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the intended destination directory using a specially crafted archive, resulting in remote code execution.

Status Published

CVE-2026-102258

Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code in the Appliance Management Console (AMC).

Last edited: 8 October 2026 2:53 pm