Sonic Wall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances
Summary: SonicWall released hotfixes for four flaws in its SMA1000 appliances, the most serious being CVE-2026-102255, a pre-authentication server-side request forgery bug in the WorkPlace portal rated 10.0 on the CVSS scale. SonicWall says it has no evidence any of the four flaws is being exploited, and the hotfix affects models 6210, 7210 and 8200v on platform-hotfix versions including 12.4.3-03526 and 12.5.0-02952.
Bottom line: This is the third time this year SonicWall has fixed a 10.0-rated, no-login SSRF flaw in WorkPlace, after pairs disclosed on July 14 and September 1 that SonicWall said were exploited in "multiple cases" and "a case" respectively. SonicWall has not said whether the new flaw can be chained with the other three the way CVE-2026-15409 and CVE-2026-15410 were combined in July to reach root, and it has issued no indicator-of-compromise or re-imaging guidance this time.