SonicWall and Splunk Patch Critical Vulnerabilities

SonicWall and Splunk both released security updates this Wednesday addressing a batch of critical and high-severity flaws, some of which allow remote code execution.

SonicWall patched four bugs in its SMA1000 appliances, advising immediate upgrades to versions 12.5.0-03082 and 12.4.3-03670. The worst of these, CVE-2026-102255, carries a maximum CVSS score of 10 and stems from an unauthenticated SSRF issue tied to an unintended alternate access route, letting an attacker make the appliance send requests on their behalf to reach internal services. The remaining fixes cover two high-severity RCE-capable issues and one medium-severity XSS flaw; SonicWall says there's no known in-the-wild exploitation so far, and clarified that SSL-VPN on its firewall line is not impacted.

Separately, Splunk pushed out fixes for numerous vulnerabilities across Splunk Enterprise, its MCP Server, and the Add-on for Amazon Web Services. Three critical-severity bugs in Splunk Enterprise could enable arbitrary command execution, unauthorized access, or code injection, while a medium-severity MCP Server flaw could let an authenticated user redirect API requests to a server they control. Splunk also addressed several third-party package vulnerabilities affecting Enterprise and the AWS add-on, with full details published on its advisories page.