SonicWall and MikroTik disclose critical security vulnerabilities

SonicWall has disclosed a critical Server-Side Request Forgery (SSRF) vulnerability, tracked as CVE-2026-102255, affecting its SMA1000 series appliances. The flaw exists in the Appliance Work Place interface and could allow unauthenticated remote attackers to force the appliance to issue requests on their behalf, potentially accessing internal functions.

In addition to the SSRF flaw, three other vulnerabilities were identified in the Appliance Management Console (AMC). These include an OS command injection vulnerability (CVE-2026-102256), a Zip Slip path traversal vulnerability (CVE-2026-102257), and a stored cross-site scripting (XSS) vulnerability (CVE-2026-102258). Users are advised to upgrade to the latest available firmware versions to remediate these risks.

Separately, a vulnerability in MikroTik RouterOS 7.x, identified as CVE-2026-67278, has been disclosed by CERT Polska. The flaw involves a weakness in RSA/PKCS#1 v1.5 signature verification. An attacker capable of redirecting outbound TLS connections could issue trusted certificates for arbitrary hostnames without a private key, potentially leading to the leakage of configuration or credential material. Affected devices should be updated to RouterOS versions 7.23.6 or 7.24.3.