SonicWall patches CVSS 10.0 pre

SonicWall issued hotfixes for four vulnerabilities in its SMA1000 remote access gateways, including a critical SSRF bug that requires no login. The company reports no evidence of exploitation and urges administrators to update.

SonicWall issued hotfixes for four vulnerabilities in its SMA1000 remote access gateways. One flaw rates 10.0 on the CVSS severity scale and allows an unauthenticated attacker to send requests through the appliance.

The most serious flaw, CVE-2026-102255, sits in WorkPlace, the portal users log into for remote access. It exists along an unintended access path through SonicWall and remains reachable before authentication. An attacker who uses that path can reach internal functionality and perform unauthorized operations, SonicWall said in a security advisory dated Oct. 6. The company did not name which functions an attacker could touch.

SonicWall rates the flaw 10.0. The company says it has no evidence any of the four flaws appears in attacks.

All four flaws affect SMA1000 models 6210, 7210 and 8200v. Version 12.4.3-03526 and older versions carry the bugs. Version 12.5.0-02952 and older versions carry the bugs too. SonicWall fixed the issues in version 12.4.3-03670 and higher, and in version 12.5.0-03082 and higher.

Appliances running 12.4.3-03526 or 12.5.0-02952 need the new hotfix. SonicWall named those versions on Sept. 1 as the fix for two flaws it reported as exploited.

SSL-VPN on SonicWall firewalls and the SMA 100 Series stay safe. SonicWall makes the hotfix available through the MySonicWall portal . The appliance restarts when the installation finishes. The advisory lists no workaround.

The other three flaws need a login. Two sit in the Appliance Management Console, where administrators configure the device.

CVE-2026-102256 is an OS command injection flaw. It needs administrator access and rates 7.8. CVE-2026-102257 is a Zip Slip flaw that lets an attacker extract files outside the intended folder. It also needs administrator access and rates 7.2. CVE-2026-102258 is a stored cross-site scripting flaw in the console. It rates 5.5.

This marks the third time this year SonicWall fixed a 10.0-rated SSRF flaw in WorkPlace that needs no login. The company disclosed CVE-2026-15409 and CVE-2026-15410 on July 14. It disclosed CVE-2026-83548 and CVE-2026-83549 on Sept. 1.

Both prior pairs combined an SSRF flaw with no login requirement and a second flaw allowing a logged-in administrator to run commands. SonicWall staff found both pairs.

Benoît Sevens of Anthropic reported CVE-2026-102255 and CVE-2026-102256. Brian Mariani of DigitalCanion SA reported the other two. One came through Trend Micro's Zero Day Initiative.

In the July attacks, CVE-2026-15409 let an attacker open a tunnel to services that respond only inside the appliance. The attacker then ran commands and used CVE-2026-15410 to gain root access. SonicWall has not said whether the new SSRF flaw combines with the other three flaws the same way.

SonicWall told customers to check appliances for indicators of compromise in its July and September advisories. It advised re-imaging or redeploying the appliance, changing user and administrator passwords and resetting TOTP tokens. The company gave no such instruction for the four new flaws.

Source : thehackernews.com