SonicWall and Splunk Patch Critical Vulnerabilities

SonicWall released patches for four vulnerabilities in its SMA1000 appliances, including a critical SSRF vulnerability (CVE-2026-102255) with a CVSS score of 10, allowing remote unauthenticated attackers to abuse an unintended alternate access path to perform unauthorized operations. Additional SonicWall vulnerabilities include two high-severity and one medium-severity flaw that could enable remote code execution and XSS attacks. Splunk addressed dozens of security flaws across Splunk Enterprise, MCP Server, and the Add-on for Amazon Web Services. Among these, three critical vulnerabilities in Splunk Enterprise could be exploited for arbitrary command execution, unauthorized access, and code injection. MCP Server had a medium-severity vulnerability allowing authenticated users to modify API settings to send requests to attacker-controlled URLs. Multiple third-party package vulnerabilities were also fixed. There is no current evidence of exploitation in the wild for these vulnerabilities.

Successful exploitation of the SonicWall SSRF vulnerability could allow unauthenticated remote attackers to bypass authentication and perform unauthorized internal requests and operations on the appliance. Other SonicWall vulnerabilities could lead to remote code execution and cross-site scripting attacks. Splunk's critical vulnerabilities could enable attackers to execute arbitrary commands, gain unauthorized access, or inject code, potentially compromising the affected systems. The MCP Server vulnerability could allow authenticated users to redirect API requests to malicious endpoints. No active exploitation has been observed.

Users of SonicWall SMA1000 appliances should update to versions 12.5.0-03082 or 12.4.3-03670 immediately to address these vulnerabilities. Splunk users should apply the latest security patches for Splunk Enterprise, MCP Server, and the Add-on for Amazon Web Services as provided in the official Splunk security advisories. SonicWall SSL-VPN products are not affected by these vulnerabilities. There is currently no evidence of exploitation in the wild, but timely patching is strongly recommended to prevent potential attacks.