Server-Side Request Forgery (SSRF) in SonicWall SMA 1000 - CVE-2026-102255
Published: October 6, 2026
Vulnerability identifier: #VU153400
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N]
CVE-ID: CVE-2026-102255
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to access internal functionality and perform unauthorized operations.
The vulnerability exists due to an unintended alternate access path in the SMA1000 Appliance Work Place interface when handling requests. A remote attacker can abuse this path to direct the appliance to issue requests on their behalf to access internal functionality and perform unauthorized operations.
Affected software
SonicWall SMA 1000
How to mitigate CVE-2026-102255
Install security update from vendor's website.
SonicWall SMA 1000 - addressed in versions 12.4.3-03670, 12.5.0-03082