SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances

SonicWall has shipped hotfixes for four vulnerabilities in its SMA1000 remote-access appliances, the most severe being a maximum-severity, pre-authentication SSRF bug in the WorkPlace login portal, tracked as CVE-2026-102255 and scored 10.0 on CVSS. The flaw stems from an unintended access route that lets an unauthenticated attacker reach internal appliance functions and carry out unauthorized actions, though SonicWall says it has found no sign of active exploitation so far. The remaining three bugs — CVE-2026-102256 (command injection enabling RCE), CVE-2026-102257 (a Zip Slip path-traversal issue in the Appliance Management Console), and CVE-2026-102258 (stored XSS in AMC) — all require prior login. All four affect SMA1000 models 6210, 7210, and 8200v running platform-hotfix versions 12.4.3-03526 or earlier, and 12.5.0-02952 or earlier; fixes land in 12.4.3-03670 and 12.5.0-03082 respectively, available via the MySonicWall portal. This marks the third unauthenticated 10.0-rated SSRF flaw SonicWall has patched in WorkPlace this year, after two earlier pairs in July and September that the company confirmed were actively exploited in real attacks.