Skip to content
SonicWall Patches SSRF Vulnerability in SMA1000 Appliances

SonicWall Patches SSRF Vulnerability in SMA1000 Appliances

First seen 14 Oct 2026, 08:28 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 14, 2026 at 08:29 UTC
  • •CVE-2026-102255 is a critical SSRF vulnerability with a CVSS score of 10.0.
  • •Affected models include SMA1000 6210, 7210, and 8200v with specific firmware versions.
  • •No evidence of active exploitation has been found, but immediate patching is recommended.

SonicWall has released patches for four vulnerabilities in its SMA1000 remote access appliances, including a SSRF vulnerability (CVE-2026-102255) with a CVSS score of 10.0. This flaw allows unauthenticated remote attackers to issue requests on behalf of the appliance, potentially accessing internal functions. The affected models include SMA1000 6210, 7210, and 8200v running specific firmware versions. SonicWall has not found evidence of but strongly recommends immediate patching. Other vulnerabilities patched include command injection and a Zip Slip vulnerability, which require admin credentials. The hotfix is available only through the MySonicWall portal, with no documented workarounds. Organizations using these appliances must act quickly to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 1h ago How this analysis works

Timeline

2026-09-01
CVE-2026-83548 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-01
CVE-2026-83549 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-07
CVE-2026-102255 published
SonicWall disclosed a critical SSRF vulnerability affecting SMA1000 appliances.
Ciberseguridadlatam
2026-10-07
CVE-2026-102256 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-07
CVE-2026-102258 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-07
CVE-2026-102257 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-09
Emergency patches released
SonicWall released hotfixes for four vulnerabilities, including CVE-2026-102255.
Ciberseguridadlatam
2026-10-12
First public PoC for CVE-2026-102255
Proof-of-concept code for the SSRF vulnerability was made publicly available.
cyberveille.esante.gouv.fr

More articles in this cluster (2)

Following this threat?

Track CVE-2026-102255 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (13)

1 / 3

Common questions

Which models are affected?
The affected models are SMA1000 6210, 7210, and 8200v running specific firmware versions.
Is there evidence of exploitation?
No, SonicWall has not found evidence of active exploitation for the critical SSRF vulnerability.
What should organizations do?
Organizations should apply the emergency patches immediately as there are no workarounds available.