SonicWall has released hotfixes for a maximum-severity server-side request forgery flaw in its SMA1000 secure remote access appliances that can be exploited without a login, BleepingComputer reported Wednesday. The company says it has seen no attacks using the bug so far, but the same product line was hit by two sets of exploited zero-days earlier this year.

What Happened

The vulnerability, tracked as CVE-2026-102255, sits in the Appliance Work Place interface, the portal remote users log in to. The Hacker News reported that it carries a CVSS score of 10.0, the highest possible. A remote, unauthenticated attacker can exploit it with low complexity to make the appliance send requests on the attacker's behalf, reaching internal functions and carrying out unauthorized operations, according to SonicWall's description.

The affected models are the SMA 6210 and 7210 hardware appliances and the 8200v virtual appliance. SonicWall said the SMA 100 series and the SSL-VPN feature on its firewalls are not affected. The fixes are in firmware 12.4.3-03670 and later and 12.5.0-03082 and later.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

The same release patches three other flaws, Help Net Security reported. Researcher Benoît Sevens, who found the SSRF bug, also reported CVE-2026-102256, an operating system command injection that requires authentication. Brian Mariani reported two flaws in the Appliance Management Console that also require a login: CVE-2026-102257, a path traversal, and CVE-2026-102258, a cross-site scripting bug.

Why It Matters

SMA1000 appliances sit at the edge of corporate networks and broker remote access to internal applications, so a flaw that needs no credentials is the kind attackers look for first. The Shadowserver Foundation tracks more than 400 SMA1000 devices exposed to the internet, according to BleepingComputer.

SonicWall says there is currently no evidence that any of the four vulnerabilities is being exploited in the wild. The Hacker News noted that SonicWall lists no workaround, which leaves upgrading as the only fix.

A Pattern on the SMA1000 Line

This is the third time in 2026 that SonicWall has disclosed a critical pre-authentication SSRF issue in SMA1000. In July, it patched CVE-2026-15409 and CVE-2026-15410, which were exploited as zero-days; BleepingComputer said those attacks deployed malware families including Sou5, OrangeTail and RootRun and were linked to ransomware gangs. In September, it fixed CVE-2026-83548 and CVE-2026-83549, which attackers chained for remote code execution.

The Cybersecurity and Infrastructure Security Agency's catalog of known exploited vulnerabilities lists 19 SonicWall flaws exploited since 2022, 13 of them in ransomware campaigns, BleepingComputer reported. That record is why security teams treat new SonicWall edge bugs as urgent even before exploitation is confirmed.

What to Watch

Administrators running affected SMA1000 models should install the fixed firmware now. The key signals in the coming days are whether a proof-of-concept or technical write-up appears and whether CISA adds CVE-2026-102255 to its catalog, which would indicate confirmed exploitation and set a patch deadline for federal agencies.