SonicWall warns of max severity SSRF flaw in SMA1000 gateways

CVE-2026-102255 is a server-side request forgery vulnerability in the Appliance WorkPlace interface of SonicWall SMA1000 series appliances (models 6210, 7210, and 8200v). The vulnerability arises from an unintended alternate access path that allows remote unauthenticated attackers to coerce the appliance into issuing requests on their behalf, potentially accessing internal functions and performing unauthorized operations. SonicWall has released hotfixes to remediate this flaw and urges customers to upgrade to the fixed versions. Although no active exploitation has been observed, the SMA1000 series is a frequent target due to its use in enterprise-grade secure remote access. Prior SMA1000 vulnerabilities have been exploited in zero-day attacks involving malware and ransomware campaigns.

If exploited, this SSRF vulnerability could allow remote unauthenticated attackers to perform unauthorized operations by making the appliance issue requests internally, potentially compromising internal functionality. This could lead to unauthorized access or manipulation of sensitive internal resources. However, there is currently no evidence of active exploitation of this specific vulnerability in the wild. The affected SMA1000 appliances are critical infrastructure components used by government agencies, MSSPs, and large enterprises, increasing the potential impact if exploited.

SonicWall has released hotfixes to address this vulnerability. Users of SMA1000 series appliances (models 6210, 7210, and 8200v) should promptly apply the provided hotfixes to mitigate the risk. SonicWall strongly advises upgrading to the fixed release versions. There is no indication that additional mitigation steps are required beyond applying the official hotfixes. Monitor vendor advisories for updates.