SonicWall fixes critical SSRF flaw in SMA1000 gateways, patches urged

What is the flaw and who is affected?

SonicWall has released hotfixes for a critical vulnerability in its SMA1000 series gateways. These devices are used by large organisations, including government agencies and managed service providers, to give remote workers secure access to internal networks and applications. The flaw, tracked as CVE-2026-102255, is rated 10.0 (the highest) on the CVSS scale. It affects SMA1000 models 6210, 7210 and 8200v. The issue does not affect SonicWall's SMA 100 Series or SSL-VPN on SonicWall firewalls.

According to BleepingComputer↗ (opens in a new tab), over 400 SMA1000 appliances are exposed to the internet, though some may already be patched. The flaw was discovered by outside researchers and patched with hotfixes released on 7 October 2026 (The Hacker News↗ (opens in a new tab)).

What could attackers do?

The vulnerability is a server-side request forgery (SSRF) bug in the WorkPlace portal of the affected appliances. SSRF means an attacker can trick the device into sending requests to internal systems on their behalf. In this case, the flaw can be exploited by someone who does not have a login. If successful, an attacker could reach internal functions and perform unauthorised operations. SonicWall has not detailed exactly which functions could be accessed or what the impact would be, but the risk is considered severe.

Has it been exploited?

SonicWall says there is no evidence that this flaw, or three others patched at the same time, have been used in real-world attacks. However, the company has a history of its SMA1000 vulnerabilities being targeted. Earlier in 2026, attackers exploited similar flaws in zero-day attacks (meaning before a patch was available) to install malware and gain full control of devices. In July and September, SonicWall confirmed active exploitation of other SSRF flaws in the same product line. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added 19 SonicWall vulnerabilities to its list of known exploited flaws in the last four years, with many linked to ransomware attacks (BleepingComputer↗ (opens in a new tab)).

What should affected organisations do?

SonicWall urges all users of SMA1000 appliances to apply the hotfixes immediately. The fixes are available through the MySonicWall portal. There is no workaround. The appliance will restart after the update. If your device is running versions 12.4.3-03526 or 12.5.0-02952, you must update to at least 12.4.3-03670 or 12.5.0-03082. Previous advisories for similar flaws recommended checking for signs of compromise and, if found, re-imaging the device and resetting passwords and authentication tokens. SonicWall has not issued such instructions for this flaw, as there is no evidence of exploitation.

Context: why are these devices targeted?

SMA1000 gateways are used to provide remote access to sensitive internal resources. This makes them a high-value target for attackers, especially ransomware groups. Past incidents show that attackers often chain SSRF flaws with other vulnerabilities to gain full control of the device. The repeated discovery of severe flaws in these devices highlights the importance of prompt patching and regular monitoring for signs of compromise.