SonicWall patches unauthenticated server-side request forgery flaw in SMA1000 secure access gateways

SonicWall released hotfixes for CVE-2026-102255, an unauthenticated server-side request forgery flaw in the Appliance WorkPlace interface of its SMA1000 secure access gateways. A remote attacker with no credentials could use an unintended alternate access path to direct the appliance to issue requests on their behalf, reaching internal functionality and performing unauthorized operations. The flaw affects SMA1000 6210, 7210, and 8200v models and does not impact the SMA 100 series or firewall SSL-VPN. SonicWall says there is no evidence of exploitation yet, but more than 400 internet-exposed SMA1000 appliances are tracked and the line has historically drawn ransomware operators.

Check

Identify internet-facing SonicWall SMA1000 6210, 7210, and 8200v appliances and apply the October 7 hotfixes immediately, given the model's history as a ransomware target.

Affected

SonicWall SMA1000 gateways on affected models let an unauthenticated remote attacker abuse an alternate access path to make the appliance reach internal functionality and perform unauthorized operations.

Fix

Apply the SonicWall hotfix release for SMA1000, restrict management interface exposure, and monitor the appliances for unexpected outbound requests to internal systems.