Affected Systems

SonicWall SMA1000 appliances (models 6210, 7210, 8200v) running platform-hotfix versions 12.4.3-03526 and older, or 12.5.0-02952 and older. The critical flaw (CVE-2026-102255) affects the WorkPlace portal. Three additional authenticated vulnerabilities also patched. SMA 100 Series and SSL-VPN on SonicWall firewalls are not affected.

Exploitation Status

No evidence of active exploitation reported by SonicWall at this time. However, this is the third CVSS 10.0 pre-authentication SSRF in WorkPlace this year; previous instances (July and September 2026) were exploited in the wild. External researchers credited for discovery.

Business Impact

Unauthenticated attackers can exploit CVE-2026-102255 to send requests through the SMA1000 appliance and reach internal functions, potentially performing unauthorized operations. The specific internal functions accessible are not disclosed. Given the pattern of prior exploitation of similar flaws in July and September 2026, this represents a high-risk attack surface for organizations using SMA1000 for remote access. Three additional flaws (CVE-2026-102256, CVE-2026-102257, CVE-2026-102258) require authentication but could enable command injection, arbitrary file write via Zip Slip, and stored XSS.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately apply hotfix 12.4.3-03670 or higher for version 12.4.3, or 12.5.0-03082 or higher for version 12.5.0 from the MySonicWall portal. Appliance will restart after installation.
  • Identify all SMA1000 appliances (models 6210, 7210, 8200v) in your environment and verify current platform-hotfix version via the Appliance Management Console.
  • Review SMA1000 access logs and authentication logs for anomalous pre-authentication requests to WorkPlace portal, especially requests targeting internal endpoints or unusual HTTP methods.
  • If indicators of compromise are found, follow SonicWall's prior guidance: re-image or redeploy the appliance, change all user and administrator passwords, and reset TOTP tokens.
  • Monitor SonicWall security advisories closely, as this is the third similar CVSS 10.0 SSRF in 2026 with a history of exploitation.