SonicWall Ships a Third CVSS 10.0 Pre-Auth SSRF Fix for SMA1000 WorkPlace This Year — New Hotfix Set Also Covers Command Injection, Zip Slip and Stored XSS
SonicWall Ships a Third CVSS 10.0 Pre-Auth SSRF Fix for SMA1000 WorkPlace This Year — New Hotfix Set Also Covers Command Injection, Zip Slip and Stored XSS
SonicWall has released hotfixes for four vulnerabilities in its SMA1000 remote-access appliances, headlined by CVE-2026-102255, a pre-authentication server-side request forgery (SSRF) flaw rated CVSS 10.0 in the WorkPlace portal that users log into. An unauthenticated attacker who abuses an unintended alternate access path can direct the appliance to issue requests on their behalf, reaching internal functionality and performing unauthorized operations. It is the third time this year SonicWall has shipped a maximum-severity, no-login SSRF fix for the same portal — and this round's affected-version list includes the exact builds that fixed September's pair.
The advisory, dated October 6 with hotfixes announced Wednesday, covers SMA1000 models 6210, 7210 and 8200v: platform-hotfix 12.4.3-03526 and older are vulnerable (fixed in 12.4.3-03670 and later), and 12.5.0-02952 and older are vulnerable (fixed in 12.5.0-03082 and later). SSL-VPN on SonicWall firewalls and the SMA 100 series are not affected. The hotfix installs from the MySonicWall portal, restarts the appliance when installation finishes, and has no workaround. SonicWall says it has no evidence that any of the four flaws is being exploited.
The other three require a login. CVE-2026-102256 (CVSS 7.8) is an OS command injection flaw that could let an authenticated administrator execute arbitrary commands on the appliance; CVE-2026-102257 (7.2) is a Zip Slip flaw in the Appliance Management Console, where a specially made archive extracts files outside the intended folder and could lead to remote code execution; CVE-2026-102258 (5.5) is stored cross-site scripting in the same console. SonicWall credited Benoît Sevens of Anthropic with the first two and Brian Mariani of DigitalCanion SA with the other two, one of them reported through Trend Micro's Zero Day Initiative.
The history is what makes this one sting. On July 14, SonicWall disclosed CVE-2026-15409 and CVE-2026-15410 — a pre-auth SSRF and a post-auth command-injection pair — and confirmed "multiple cases" of exploitation; Rapid7 showed the SSRF opened a tunnel to services reachable only inside the appliance, and the second flaw turned that foothold into full root control. On September 1, CVE-2026-83548 and CVE-2026-83549 repeated the exact shape, again with confirmed exploitation. Both earlier pairs were found by SonicWall's own staff; this one came from outside researchers. After July, SonicWall told customers to re-image compromised appliances, rotate every user and administrator password, and reset the TOTP tokens used for one-time login codes — guidance it has not repeated this time.
What Should You Do?
- Apply the platform hotfix now — 12.5.0-03082 or later, or 12.4.3-03670 or later — and schedule the restart the installation forces.
- Check your build, not your memory: an appliance patched to September's 12.5.0-02952 or 12.4.3-03526 is still vulnerable to this round's SSRF, because those builds are in the new affected list.
- Keep WorkPlace and the management console off the open internet: restrict the portal to trusted networks and VPN'd management wherever the deployment allows it.
- Watch for SSRF tells: outbound requests from the appliance that nobody initiated, and unknown-source hits on internal-only services. If you find signs of compromise, use the July playbook — re-image the appliance, rotate all user and administrator credentials, reset TOTP tokens.
The WAF Angle
An SSRF in a remote-access gateway is an edge problem wearing an edge costume: the appliance is the thing your users traverse, and the flaw turns it into a proxy for the attacker. A WAF or reverse proxy in front of the WorkPlace portal can catch blunt traversal and probing patterns, but SonicWall's "unintended alternate access path" phrasing means the request that matters may look legitimate to any rule set — which is why patching and exposure reduction lead the mitigation list, not filtering. Architecturally, the July chain holds the lesson for this one too: internal services must not implicitly trust the SMA1000 just because the appliance can reach them. Three maximum-severity pre-auth bugs in one component in under a year is a product-security pattern, not bad luck — regression-test your internet-facing portals for alternate access paths, and size your monitoring accordingly.
