Overview
- SonicWall released hotfix firmware on Tuesday to fix four SMA1000 vulnerabilities, including CVE-2026-102255, a pre-authentication server‑side request forgery rated CVSS 10.0 that can make the appliance issue requests to internal endpoints.
- The flaws affect SMA1000 models 6210, 7210 and 8200v and customers must install platform hotfix versions 12.4.3-03670+ or 12.5.0-03082+ from the MySonicWall portal because there is no workaround and the appliance restarts after installation.
- SonicWall says it has found no evidence the newly patched flaws are being exploited in the wild, but the company warned users to upgrade immediately given repeated targeting of SMA1000 gateways earlier in 2026.
- The three additional fixes address vulnerabilities that require login: CVE-2026-102256 is an authenticated OS command injection (CVSS 7.8), CVE-2026-102257 is a Zip Slip path‑traversal (CVSS 7.2), and CVE-2026-102258 is a stored XSS (CVSS 5.5); researchers Benoît Sevens and Brian Mariani are credited for the reports.
- Security groups track more than 400 internet‑exposed SMA1000 appliances so unpatched systems remain a high‑value target for attackers and organizations should follow prior SonicWall guidance to check for compromise and consider reimaging if signs of intrusion are found.