CVE-2026-102258: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in SonicWall SMA1000

CVE-2026-102258 is a stored cross-site scripting (XSS) vulnerability in the SonicWall SMA1000 Appliance Management Console. The vulnerability arises from improper neutralization of input during web page generation, classified under CWE-79. It requires the attacker to be authenticated as an administrator to exploit, enabling them to inject and execute arbitrary JavaScript code in the AMC, potentially impacting the management console's integrity and security.

An authenticated administrator could exploit this vulnerability to execute arbitrary JavaScript code within the Appliance Management Console. This could lead to unauthorized actions within the management interface, session hijacking, or other attacks facilitated by script execution in the context of the AMC. However, exploitation requires administrative authentication, limiting the attack surface.

No patch or official remediation information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, restrict administrative access to trusted personnel only and monitor for suspicious activity within the management console.