SonicWall SMA1000 Flaw Prompts Hotfixes for Maximum-Severity Vulnerability

SonicWall has issued hotfixes for a maximum-severity vulnerability affecting its SMA1000 secure remote access appliances. The SonicWall SMA1000 flaw could allow attackers without login credentials to make vulnerable gateways perform unauthorized operations.

The company urged customers to install the updates promptly. However, it said there was no evidence of active exploitation when it announced the fixes.

Which SonicWall Appliances Are Affected?

Tracked as CVE-2026-102255, the server-side request forgery vulnerability affects the Appliance WorkPlace interface on SMA1000 6210, 7210 and 8200v models.

By contrast, the issue does not affect the SMA 100 Series. SSL-VPN services running on SonicWall firewalls also fall outside its scope.

The weakness involves an unintended alternative access path within the affected interface. Attackers can exploit it remotely without privileges, and the attack requires little complexity.

Through that path, an attacker could cause the appliance to send requests on their behalf. As a result, they could potentially reach internal functions and carry out operations they lack permission to perform.

Hotfixes Available as Hundreds of Gateways Remain Online

SonicWall released the hotfixes on October 6 and advised customers to upgrade affected physical and virtual appliances.

Meanwhile, Shadowserver data cited in the report showed more than 400 internet-exposed SMA1000 gateways. That figure does not establish how many remain vulnerable, since some operators may already have installed the updates.

Although SonicWall reported no known exploitation, the vulnerability affects equipment that provides access to sensitive corporate resources. Consequently, organizations using the affected models have a strong reason to prioritize remediation.

SMA1000 gateways support remote access to internal applications and networks. Government agencies, managed security service providers and large businesses use these appliances.

Previous SMA1000 Attacks Add Urgency

The SonicWall SMA1000 flaw follows several earlier vulnerabilities that attackers exploited before fixes became available.

In July, attackers used CVE-2026-15409 and CVE-2026-15410 for weeks to deploy custom malware on vulnerable appliances. Those attacks involved Sou5, OrangeTail and RootRun malware.

The U.S. Cybersecurity and Infrastructure Security Agency subsequently linked exploitation of those vulnerabilities to ransomware groups.

Then, in September, SonicWall warned about another pair of actively exploited flaws: CVE-2026-83548 and CVE-2026-83549. Attackers combined them to execute code remotely on affected gateways.

Across the previous four years, CISA added 19 SonicWall vulnerabilities to its Known Exploited Vulnerabilities catalog. Of those, 13 also had links to ransomware attacks.

However, those earlier incidents do not establish exploitation of CVE-2026-102255. For this newly disclosed issue, SonicWall’s guidance is to install the available hotfixes before attackers potentially exploit it.