Critical SSRF Vulnerability (CVE‑2026‑102255) in SonicWall SMA1000 Gateways
What Happened – SonicWall released hot‑fixes for a maximum‑severity server‑side request forgery (SSRF) flaw (CVE‑2026‑102255) affecting the Appliance WorkPlace interface of SMA1000 6210, 7210 and 8200v models. An unauthenticated remote attacker can force the appliance to issue arbitrary internal requests, potentially reaching internal services and performing unauthorized operations. No evidence of active exploitation has been observed to date.
Why It Matters for Trust & Control Assurance
- Continuous control‑mapping programs must capture configuration and patch status of network‑edge devices to provide defensible audit evidence.
- Timely remediation of high‑severity vulnerabilities demonstrates due‑diligence and satisfies the “maintain secure configurations” control objective across multiple frameworks.
- Evidence of patch deployment can be leveraged in third‑party risk assessments and compliance audits.
Who Is Affected – Government agencies, Managed Service Providers (MSSPs), and large enterprises that rely on SMA1000 gateways for secure remote access.
Recommended Actions – Deploy the SonicWall hot‑fixes immediately, update your asset inventory to reflect the patched state, run vulnerability scans to confirm remediation, and document the remediation steps for audit readiness. Source: BleepingComputer
Technical Notes – The flaw is an SSRF (CVE‑2026‑102255) in the Appliance WorkPlace interface of SMA1000 6210/7210/8200v. It is classified as max severity, exploitable without authentication, and has not yet been observed in the wild. Prior SMA1000 zero‑days have been linked to ransomware activity. Source: BleepingComputer