[REVISION HISTORY]

SonicWall SMA1000 series security vulnerabilities

Updated 2 times since CLSTR started tracking revisions of this situation.

What changed

2026-10-11 09:57 UTC → 2026-10-13 19:35 UTC · added ~~removed~~

SonicWall disclosed several critical security vulnerabilities in its SMA1000 series appliances, including a Server-Side Request Forgery (SSRF) flaw (CVE-2026-102255), an OS command injection vulnerability, a Zip Slip path traversal vulnerability, and a stored cross-site scripting (XSS) vulnerability. By the following day, reports indicated that the maximum-severity SSRF vulnerability was under active exploitation, allowing unauthenticated remote attackers to perform unauthorized operations by directing the appliance to issue requests on their behalf. Security researchers at Previdian have confirmed exploitation attempts within 24 hours of disclosure. The SSRF vulnerability, which carries a CVSS score of 10.0, allows unauthenticated attackers to reach internal services via the WorkPlace Extraweb interface. This flaw specifically affects SMA 6210, 7210, and 8200v models. Recent intelligence from Defused Cyber and Previdian detected the first signs of exploitation on October 8, 2026. Data from Previdian indicates that 135 attempts have been observed originating from two unique IP addresses located in the United States. Although SonicWall released patches for the vulnerability on October 6, 2026—specifically versions 12.4.3-03670 and 12.5.0-03082—threat actors continue to target the appliances. This follows a pattern of similar exploits in June 2026, where zero-day flaws in the same product line were used to deploy malware and extract high-value credentials.

Versions

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.