SonicWall patches critical SSRF flaw in SMA1000 gateways

SonicWall has released hotfixes for a maximum-severity server-side request forgery (SSRF) flaw in its SMA1000 series appliances. Tracked as CVE-2026-102255, the vulnerability affects the Appliance WorkPlace interface in the SMA1000 6210, 7210 and 8200v models. SonicWall says it does not affect the SMA 100 Series or SSL-VPN running on its firewalls.

The flaw involves an unintended alternate access path. SonicWall says remote attackers without privileges could exploit it in low-complexity attacks to make an appliance issue requests on their behalf, reach internal functionality and perform unauthorized operations.

The company urged SMA1000 customers to install the hotfixes released on Tuesday. It said there is currently no evidence that the vulnerabilities addressed in the release are being exploited in the wild. Shadowserver tracks more than 400 internet-exposed SMA1000 appliances, though some may already be patched.

SMA1000 gateways provide secure remote access to internal apps and corporate networks for government agencies, managed service providers and large companies. Earlier this year, attackers exploited two SMA1000 zero-days, CVE-2026-15409 and CVE-2026-15410, for weeks to install Sou5, OrangeTail and RootRun malware. CISA linked those attacks to ransomware gangs. Last month, SonicWall warned that attackers were chaining two other zero-days, CVE-2026-83548 and CVE-2026-83549, to execute remote code on vulnerable gateways. CISA has added 19 SonicWall vulnerabilities to its actively exploited list over the last four years; 13 were also used in ransomware attacks.