CVE-2026-102257PATCHED

sonicwall · sma1000

CVE-2026-102257: A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extrac

Description

A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the intended destination directory using a specially crafted archive, resulting in remote code execution.

Affected Products

Vendor	Product	Versions
sonicwall	sma1000	12.4.3-03526 (platform-hotfix) and older versions, 12.5.0-02952 (platform-hotfix) and older versions

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017(vendor-advisory)

Related News (5 articles)

Tier D

Heise Security2h ago

Jetzt patchen! SonicWall SMA1000 im Fokus von Angreifern

→ No new info (linked only)

Tier D

Heise Security5d ago

SonicWall SMA1000: Lücke mit Höchstwertung öffnet interne Funktionen

→ No new info (linked only)

Tier C

VulDB5d ago

CVE-2026-102257 | SonicWall SMA1000 Appliance Management Console path traversal

→ No new info (linked only)

Tier B

BSI Advisories5d ago

[NEU] [hoch] SonicWall SMA1000: Mehrere Schwachstellen

→ No new info (linked only)

Tier B

CERT-FR6d ago

Multiples vulnérabilités dans Sonicwall Secure Mobile Access (07 octobre 2026)

→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.17.2 HIGH

VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA KEV❌ No

Actively exploited❌ No

Patch available

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017

CWECWE-22

PublishedOct 7, 2026

Last enriched5d ago

Trending Score51

Source articles5

Independent4

Info Completeness4/14

Missing: vendor, product, versions, cvss, epss, kev, exploit, patch, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

CRITICALCVE-2026-102255

CVE-2026-102255: A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended altern

Trending: 82

CRITICALCVE-2026-83548EXPKEV

CVE-2026-83548: A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended altern

Trending: 81

HIGHCVE-2026-83549EXPKEV

CVE-2026-83549: Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi

Trending: 75

HIGHCVE-2026-102256

CVE-2026-102256: Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi

Trending: 33

MEDIUMCVE-2026-102258

CVE-2026-102258: Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Managem

Trending: 26

Pin to Dashboard

Verification

State: verified

Confidence: 100%

Vulnerability Timeline

CVE Published

Oct 7, 2026

Discovered by ZDM

Oct 7, 2026

Patch Available

Oct 8, 2026