Overview
- SonicWall published hotfix firmware on Wednesday that fixes four vulnerabilities in SMA1000 6210, 7210 and 8200v appliances and named the fixed builds as 12.4.3-03670+ and 12.5.0-03082+.
- The most serious flaw, CVE-2026-102255, is a pre-authentication server-side request forgery that lets an unauthenticated attacker force the appliance to send requests to internal endpoints and perform unauthorized actions.
- SonicWall says there is no current evidence these four flaws are being exploited in the wild but strongly urges customers to install the hotfixes immediately to block potential attacks.
- Security trackers report more than 400 internet-exposed SMA1000 gateways, which leaves many organizations at risk given that earlier 2026 SMA zero-days were exploited to install malware such as Sou5, OrangeTail and RootRun in attacks CISA has linked to ransomware groups.
- Customers and managed service providers should patch urgently, inventory internet-facing SMA1000 devices, and check remote-access appliances for signs of compromise because a breached gateway can give attackers a path into internal networks and allow malware deployment.