Cybersecurity Threat Advisory: Critical SonicWall SMA 1000 Flaws Open Remote Access Gateways to Attack

Threat update

SonicWall has released fixes for four vulnerabilities in its SMA 1000 Secure Mobile Access appliances, the gateways many organizations use to give staff remote access to internal systems. The worst of the four scores a perfect 10.0 and can be exploited by an attacker with no username or password. SonicWall hasn't reported active exploitation yet, but security teams are already seeing increased scanning of internet-facing SMA 1000 devices. If you run one, patch it now.

Technical Detail and Additional Info

What is the threat?

SonicWall published advisory SNWLID-2026-0017 on October 6, 2026. It covers four flaws affecting physical and virtual SMA 6210, SMA 7210, and SMA 8200v appliances:

• CVE-2026-102255 (CVSS 10.0): A server-side request forgery (SSRF) flaw in the WorkPlace interface. An attacker on the internet, without logging in, can make the appliance send requests on their behalf. In practice, that turns your gateway into a proxy into your internal network.
• CVE-2026-102256 (CVSS 7.8): A command injection flaw that lets a logged-in administrator, or anyone holding stolen admin credentials, run operating system commands on the appliance.
• CVE-2026-102257 (CVSS 7.2): A "Zip Slip" path traversal flaw in the Appliance Management Console (AMC). A crafted archive can write files outside their intended folder, which may lead to code execution.
• CVE-2026-102258 (CVSS 5.5): A stored cross-site scripting (XSS) flaw in the AMC that can trigger when an administrator views the affected content, opening the door to session hijacking, credential theft, or unauthorized settings changes.

Affected versions are 12.4.3-03526 and earlier and 12.5.0-02952 and earlier. The fixes are in 12.4.3-03670 and 12.5.0-03082 or later. SonicWall has not listed a workaround. 

SonicWall firewall SSL-VPN products and SMA 100 Series appliances are not affected. 

Why is it noteworthy?

A remote access gateway sits right on the edge of your network. It faces the internet on one side and trusts your internal systems on the other. A flaw that needs no login on a device like that is about as serious as it gets.

There's also recent history here. In July 2026, SonicWall patched a different SSRF flaw in the same WorkPlace interface, also rated 10.0. Attackers chained it with a second bug to take full control of appliances. CISA added both to its Known Exploited Vulnerabilities catalog and flagged them as used in ransomware campaigns. Attackers already know this product and have tooling built around it.

One more thing to watch: the September updates (12.4.3-03526 and 12.5.0-02952) are on the affected list. If you patched last month and assumed you were current, you are not. 

What is the exposure or risk?

Organizations face the most risk when:

• SMA 1000 appliances are running any version older than the October fixes
• The WorkPlace portal or the management console can be reached from the open internet
• Admin accounts use weak or reused passwords, or don't require MFA
• Internal apps and management interfaces reachable through the gateway have little extra protection

If attackers get in, they could:

• Reach internal web apps, admin panels, and cloud metadata services that were never meant to be exposed
• Map your internal network and look for weak spots to use in a follow-on attack
• Combine the SSRF flaw with stolen admin credentials and the other bugs to take over the appliance completely
• Watch or tamper with remote access traffic and steal credentials and data passing through it
• Establish a lasting foothold for lateral movement or ransomware, or knock out remote access for your staff

What are the recommendations?

 LBT Technology Group recommends the following actions:

• Patch immediately. Update every SMA 1000 appliance to 12.4.3-03670, 12.5.0-03082, or the latest hotfix in MySonicWall. Don't count September's update as protection.
• Confirm what you actually have. Inventory your SonicWall gear so you know which devices are SMA 1000 appliances. Firewalls and SMA 100 Series units aren't affected, so don't burn time on them for this advisory.
• Get the management console off the internet. Limit access to the AMC and, where possible, the WorkPlace portal with IP allowlists, a jump host, or VPN-only access.
• Lock down admin accounts. Require MFA, remove accounts nobody uses, and enforce strong, unique passwords for every administrator.
• Look for signs of compromise. Review logs for odd internal requests coming from the appliance, unexpected archive uploads, unusual admin activity, and repeated failed logins. Check for unauthorized configuration changes, unfamiliar processes, and modified files.
• Don't let the gateway be the only gate. Segment your network and add authentication and access controls to internal apps and APIs reachable through the appliance, so a compromised gateway doesn't mean open access to everything behind it.
• Put edge devices on a fast track. Treat VPNs, remote access gateways, and firewalls as critical assets with a defined deadline for reviewing and applying security advisories.

Not sure whether your remote access gear is patched, or whether its admin console is sitting on the open internet? Contact LBT Technology Group for a no-pressure review of your network edge.

References

 For more in-depth information about the recommendations, please visit the following links:

• Baran, Guru. "SonicWall Patches 4 SMA1000 Flaws, Including Critical Pre-Auth SSRF Rated CVSS 10." Cyber Security News, October 7, 2026.
• Cyber Security Agency of Singapore. "Critical Vulnerability in SonicWall SMA1000 Series." CSA Alert AL-2026-137, October 8, 2026.
• Abinaya. "CISA Warns of SonicWall SMA1000 Vulnerabilities Exploited in Attacks to Deploy Ransomware." Cyber Security News, August 11, 2026.