SonicWall patches a max-severity SSRF in SMA1000 gateways

SonicWall has shipped hotfixes for a server-side request forgery flaw in its SMA1000 gateways that a remote, unauthenticated attacker can trigger in a low-complexity attack. The bug, CVE-2026-102255, carries a maximum severity rating and lives in the Appliance WorkPlace interface of the 6210, 7210, and 8200v models.

The weakness is what SonicWall calls an unintended alternate access path. By reaching the WorkPlace interface through that path, an attacker can get the appliance to issue requests on their behalf. SonicWall’s own description is that this lets an attacker “reach internal functionality and perform unauthorized operations” with no credentials. That is the usual SSRF outcome: the gateway becomes a proxy into whatever it can talk to, and on a remote-access appliance that is the internal network it was deployed to front.

The SMA 100 series is not affected, and neither is the SSL-VPN running on SonicWall firewalls. If those are what you run, this particular CVE does not touch you. The hotfixes are for the SMA1000 line only, and upgrading to the fixed release is the mitigation SonicWall offers. Taking the appliance off the internet, the obvious interim move, is not really an option while it is doing its job: an SMA1000 exists to terminate remote access from the internet.

SonicWall says there is no evidence any of the flaws in this release are being exploited yet, and it has not flagged CVE-2026-102255 as actively exploited. The urgency is in the track record rather than live attacks. Shadowserver currently counts more than 400 SMA1000 appliances exposed to the internet, some of which may already be patched.

The reason to treat this one seriously is who runs these boxes and how fast attackers have moved on earlier SMA1000 bugs. These are enterprise secure remote access gateways sitting in front of government agencies, MSSPs, and large corporate networks, handing out VPN access to internal apps. That makes them a high-value target, and the device’s whole purpose means a successful SSRF lands you adjacent to everything the gateway can reach.

The recent history backs that up. In July, two SMA1000 zero-days, CVE-2026-15409 and CVE-2026-15410, were exploited for weeks to install custom Sou5, OrangeTail, and RootRun malware on vulnerable appliances. CISA linked that activity to ransomware gangs. Last month SonicWall warned that attackers were chaining two more zero-days, CVE-2026-83548 and CVE-2026-83549, to run code remotely on SMA1000 gateways. Over the past four years CISA has added 19 SonicWall vulnerabilities to its known-exploited list, 13 of them also abused in ransomware.

Against that pattern, “no evidence of exploitation” is the current state, not a guarantee of the next few weeks. A maximum-severity, unauthenticated, low-complexity SSRF on a device class that attackers have repeatedly weaponised as a zero-day is the kind of thing that moves from patch to exploit quickly once the fix is public and researchers start diffing it.

If you operate any of the affected models, apply the hotfix now and confirm the running version afterward, since virtual and physical appliances are both in scope. Then check what the gateway can actually reach: an SSRF is only as useful as the internal services it can be pointed at, so segmenting the appliance away from management interfaces, metadata endpoints, and anything else it has no reason to call limits the blast radius of this bug and the next one. Given how often SMA1000 flaws have shown up in CISA’s exploited list, there will be a next one.