SonicWall patches max-severity SSRF flaw in SMA1000 gateways

SonicWall has shipped emergency hotfixes for a maximum-severity vulnerability in its SMA1000 series remote-access gateways. Tracked as CVE-2026-102255, the flaw was found in the Appliance WorkPlace interface of the 6210, 7210, and 8200v models. According to the company, the SMA 100 series and SSL-VPN running on SonicWall firewalls are not affected.

What the flaw is

The vulnerability is a server-side request forgery (SSRF) issue rooted in an unintended alternate access-path weakness. It can be abused by a remote, unprivileged attacker in low-complexity attacks.

"By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations," SonicWall explained.

Fix already available

The hotfixes were released on Tuesday, and the company strongly urges owners of both virtual and physical SMA1000 appliances to upgrade to the fixed release. SonicWall says there is currently no evidence the flaw is being exploited in the wild.

Threat-tracking service Shadowserver counts over 400 Internet-exposed SMA1000 appliances, though some may already be patched.

Why it matters

SMA1000 gateways are enterprise-grade secure remote access devices used by government agencies, managed service providers (MSSPs), and large corporations to grant VPN access to internal apps and corporate networks — which is precisely why they keep drawing attackers' attention.

Since the start of the year, SMA1000 appliances have repeatedly been hit through zero-day flaws. In July, two of them (CVE-2026-15409 and CVE-2026-15410) were exploited for weeks to plant custom Sou5, OrangeTail, and RootRun malware; CISA linked those attacks to ransomware gangs. A month earlier, SonicWall warned of two new zero-days (CVE-2026-83548 and CVE-2026-83549) being chained for remote code execution.

Over the past four years, CISA has added 19 SonicWall vulnerabilities to its catalog of actively exploited flaws, 13 of which have also figured in ransomware attacks.

Source: Bleeping Computer