SonicWall patches CVSS 10 pre-login flaw in SMA1000 gateways

SonicWall patches CVSS 10 pre-login flaw in SMA1000 gateways

6 October 2026: SonicWall has released hotfixes for four vulnerabilities in its SMA1000 secure remote access appliances. The worst, CVE-2026-102255, is a server-side request forgery flaw in the WorkPlace portal that scores the maximum 10.0 and needs no login. An attacker who can reach the portal could use it to get at internal functionality and carry out unauthorised operations. Reports on the advisory say there is no evidence of active exploitation so far.

Not yet independently verified. SonicWall's advisory page needs a browser to render, so the version and score details come from two trade reports that cite it. Check the advisory before scheduling the change. We will update this when it can be confirmed, and remove this note.

SonicWall published the advisory as SNWLID-2026-0017 on 6 October. The Italian national cybersecurity agency ACN issued its own notice the next day, naming the 6210, 7210 and 8200v models of the SMA1000 series.

The other three flaws need some level of access first:

• CVE-2026-102256: OS command injection leading to code execution, requires an administrator account, CVSS 7.8
• CVE-2026-102257: a Zip Slip path-traversal flaw, requires a login, CVSS 7.2
• CVE-2026-102258: stored cross-site scripting, requires an administrator account, CVSS 5.5

Fixed versions

The hotfixes cover the two release lines that are still supported:

• 12.4.3: versions 12.4.3-03526 and older are affected, 12.4.3-03670 and later are fixed
• 12.5.0: versions 12.5.0-02952 and older are affected, 12.5.0-03082 and later are fixed

Why the repeat matters

Trade coverage points out that this is the third pre-authentication WorkPlace request-forgery flaw with a 10.0 score that SonicWall has patched in 2026. The same portal component has therefore produced a maximum-severity bug three times in one year, and WorkPlace is the user-facing portal of the appliance.

The practical test for a team running SMA1000 is whether the WorkPlace portal answers on a public address. If it does, the pre-login flaw is the one to patch first, and the administrator-level bugs can follow in the same maintenance window. Teams that have not recorded which of the two version lines each appliance runs should read it from the appliance before choosing a hotfix.

Company profile on TrustList: SonicWall

Related on TrustList:

• NetScaler CVE-2026-88771: public exploit turns targeted attacks into mass scanning — patch and hunt now
• Edge devices are attacked first, application servers after the patch
• FBI warns FortiBleed is still hitting exposed FortiGate VPNs

Sources

• SonicWall PSIRT: SNWLID-2026-0017 (page content did not load for us), 6 October 2026
• The Hacker News: SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances, 7 October 2026
• Security Affairs: SonicWall Fixes Max Severity Pre-Auth Flaw in SMA1000 Appliances, 7 October 2026