SonicWall SMA1000: max-severity pre-auth SSRF exploited days after the patch (CVE-2026-102255)
SonicWall SMA1000 (6210, 7210, 8200v)
CVE-2026-102255 (CVSS 10.0) is a pre-authentication server-side request forgery in the SMA1000 Appliance Work Place interface: an unintended alternate access path lets a remote attacker make the appliance send requests to internal functionality and perform unauthorized operations. It affects SMA1000 6210, 7210 and 8200v models (not SMA 100 or firewall SSL-VPN). SonicWall disclosed it on Oct 6; exploitation attempts began Oct 8, and Horizon3.ai warns it can lead to device takeover. Update to 12.4.3-03670 or 12.5.0-03082.
Why this severity: CVSS 10.0; pre-auth; exploitation attempts observed since 2026-10-08
- Started
- Oct 6, 2026
Affected
- SMA1000 6210, 7210, 8200v before 12.4.3-03670 / 12.5.0-03082
Fixed in
- 12.4.3-03670
- 12.5.0-03082
Timeline3
Advisories1
News & write-ups3
Notes & caveats
Not in CISA KEV as of the 2026-10-23 catalog. No successful compromise has been publicly confirmed; reports describe exploitation attempts.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
