Zero Day MonitorZDM

← Back to list

10.0

CVE-2026-102255PATCHED

sonicwall · sma1000

CVE-2026-102255: A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended altern

Description

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.

Affected Products

Vendor	Product	Versions
sonicwall	sma1000	12.4.3-03526 (platform-hotfix) and older versions, 12.5.0-02952 (platform-hotfix) and older versions

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017(vendor-advisory)

Related News (12 articles)

Tier D

Heise Security1h ago

Jetzt patchen! SonicWall SMA1000 im Fokus von Angreifern

→ No new info (linked only)

Tier D

The Hacker News22h ago

Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch

→ No new info (linked only)

Tier D

SecurityWeek1d ago

Critical SonicWall Vulnerability Exploited Days After Disclosure

→ No new info (linked only)

Tier D

Help Net Security2d ago

Week in review: FortiBleed is still active, Patch Tuesday forecast

→ No new info (linked only)

Tier D

BleepingComputer3d ago

Max severity SonicWall SMA1000 flaw now exploited in attacks

→ No new info (linked only)

Tier D

SecurityWeek4d ago

SonicWall and Splunk Patch Critical Vulnerabilities

→ No new info (linked only)

Tier D

Heise Security4d ago

SonicWall SMA1000: Lücke mit Höchstwertung öffnet interne Funktionen

→ No new info (linked only)

Tier D

CSO Online5d ago

SonicWall’s latest critical flaw indicates a security pattern, not another one-off bug

→ No new info (linked only)

Tier D

The Hacker News5d ago

SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances

→ No new info (linked only)

Tier C

VulDB5d ago

CVE-2026-102255 | SonicWall SMA1000 Work Place Interface server-side request forgery

→ No new info (linked only)

Tier B

BSI Advisories5d ago

[NEU] [hoch] SonicWall SMA1000: Mehrere Schwachstellen

→ No new info (linked only)

Tier B

CERT-FR6d ago

Multiples vulnérabilités dans Sonicwall Secure Mobile Access (07 octobre 2026)

→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.110.0 CRITICAL

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA KEV❌ No

Actively exploited❌ No

Patch available

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017

CWECWE-918, CWE-441

PublishedOct 7, 2026

Trending Score82

Source articles12

Independent9

Info Completeness0/14

Missing: cve_id, title, description, vendor, product, versions, cvss, epss, cwe, kev, exploit, patch, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

CRITICALCVE-2026-83548EXPKEV

CVE-2026-83548: A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended altern

HIGHCVE-2026-83549EXPKEV

CVE-2026-83549: Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi

HIGHCVE-2026-102257

CVE-2026-102257: A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extrac

HIGHCVE-2026-102256

CVE-2026-102256: Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi

MEDIUMCVE-2026-102258

CVE-2026-102258: Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Managem

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Oct 7, 2026

Discovered by ZDM

Oct 7, 2026

Patch Available

Oct 7, 2026