Critical Pre‑Auth SSRF Vulnerability (CVSS 10.0) in SonicWall SMA1000 Remote‑Access Appliances
What Happened — SonicWall disclosed four security flaws in its SMA1000 series, the most severe being a pre‑authentication Server‑Side Request Forgery (SSRF) that scores a perfect 10.0 on the CVSS scale. An unauthenticated attacker could craft a request that the appliance forwards internally, potentially reaching protected services behind the gateway.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability‑management controls that detect, assess, and remediate critical flaws before they can be weaponised.
- Highlights the importance of maintaining auditable patch‑management evidence to satisfy multiple frameworks (e.g., NIST CSF, ISO 27001) with a single control objective.
- Aligns with Verisq’s Control Mapping capability, which helps organisations map the patch‑management control to framework requirements and capture continuous proof of remediation.
Who Is Affected
- Enterprises that deploy SonicWall SMA1000 appliances for remote‑worker VPN access (across finance, healthcare, technology, and other sectors).
Recommended Actions
- Apply the SonicWall hotfixes immediately on all SMA1000 devices.
- Verify patch deployment through automated configuration‑management tools and retain evidence for audit readiness.
- Update your vulnerability‑management policy to include pre‑auth SSRF checks for remote‑access gateways.
Technical Notes
- Attack Vector: Pre‑authentication SSRF via malformed HTTP request.
- CVSS Base Score: 10.0 (Critical).
- Affected Product: SonicWall SMA1000 series (firmware versions prior to the October 2026 hotfix).
- Potential Impact: Unauthorized internal network access, data exfiltration, or lateral movement if exploited.
Source: The Hacker News