Zero Day MonitorZDM

← Back to list

6.1

CVE-2026-102258PATCHED

sonicwall · sma1000

CVE-2026-102258: Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Managem

Description

Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code in the Appliance Management Console (AMC).

Affected Products

Vendor	Product	Versions
sonicwall	sma1000	12.4.3-03526 (platform-hotfix) and older versions, 12.5.0-02952 (platform-hotfix) and older versions

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017(vendor-advisory)

Related News (5 articles)

Tier D

Heise Security5d ago

SonicWall SMA1000: Lücke mit Höchstwertung öffnet interne Funktionen

→ No new info (linked only)

Tier D

The Hacker News5d ago

SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances

→ No new info (linked only)

Tier C

VulDB5d ago

CVE-2026-102258 | SonicWall SMA1000 Appliance Management Console cross site scripting

→ No new info (linked only)

Tier B

BSI Advisories6d ago

[NEU] [hoch] SonicWall SMA1000: Mehrere Schwachstellen

→ No new info (linked only)

Tier B

CERT-FR6d ago

Multiples vulnérabilités dans Sonicwall Secure Mobile Access (07 octobre 2026)

→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.16.1 MEDIUM

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA KEV❌ No

Actively exploited❌ No

Patch available

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017

CWECWE-79

PublishedOct 7, 2026

Last enriched5d ago

Trending Score25

Source articles5

Independent5

Info Completeness4/14

Missing: vendor, product, versions, cvss, epss, kev, exploit, patch, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

CRITICALCVE-2026-83548EXPKEV

CVE-2026-83548: A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended altern

CRITICALCVE-2026-102255

CVE-2026-102255: A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended altern

HIGHCVE-2026-83549EXPKEV

CVE-2026-83549: Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi

HIGHCVE-2026-102257

CVE-2026-102257: A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extrac

HIGHCVE-2026-102256

CVE-2026-102256: Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi

Pin to Dashboard

Verification

State: verified

Confidence: 100%

Vulnerability Timeline

CVE Published

Oct 7, 2026

Discovered by ZDM

Oct 7, 2026

Patch Available

Oct 7, 2026