SonicWall fixes pre-auth SSRF flaw in SMA 1000 appliances (CVE-2026-102255)

SonicWall has released fixes for four vulnerabilities in its SMA 1000 series SSL VPN gateways, the most serious of which, CVE-2026-102255, lets an unauthenticated remote attacker abuse the appliance's Work Place interface to trigger an SSRF and trick the device into making requests to internal, trusted endpoints — effectively performing actions reserved for authenticated users or admins. The vendor says there is no current evidence of in-the-wild exploitation, but notes the risk given that SonicWall SMA appliances have repeatedly been targeted as zero-days in the past, including two other pre-auth SSRF bugs earlier in 2026 (CVE-2026-15409 and CVE-2026-83548). The other three flaws — CVE-2026-102256 (post-auth OS command injection), CVE-2026-102257 (path traversal) and CVE-2026-102258 (XSS) — require authenticated access, with the latter two needing admin credentials. The issues affect SMA 1000 models 6210, 7210 and 8200v (physical and virtual); SonicWall firewalls and the discontinued SMA 100 line are not impacted. Administrators should update to hotfix firmware versions 12.4.3-03670 or 12.5.0-03082 and higher.