Remote access gateway vendor SonicWall has distributed patches addressing a critical SSRF vulnerability in its SMA1000 product line. Designated CVE-2026-102255, the flaw resides in the Appliance WorkPlace interface across SMA1000 6210, 7210, and 8200v models. The SMA 100 Series and SSL-VPN implementations running on SonicWall firewalls remain unaffected by this issue.
The vulnerability stems from an unintended alternate access path that allows remote attackers without authentication to launch low-complexity attacks. According to SonicWall, "By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations."
Although no active exploitation has been documented, SonicWall urged customers to deploy the hotfixes released Tuesday. The vendor stated: "SonicWall strongly advises users of the SMA1000 series appliances to upgrade to the mentioned fixed release version to address these vulnerabilities. There is currently no evidence any of the vulnerabilities addressed in this release are being exploited in the wild."
Security monitoring firm Shadowserver has identified more than 400 SMA1000 appliances accessible from the internet, though some may have already received patches. The devices are particularly attractive targets because they serve as enterprise-grade secure remote access solutions deployed by government agencies, Managed Service Providers, and large corporations to enable VPN connectivity to internal applications and networks.
History of SMA1000 Exploitation
SMA1000 vulnerabilities have drawn sustained attention from threat actors throughout 2026. In July, two zero-day flaws (CVE-2026-15409 and CVE-2026-15410) were weaponized for weeks to deploy custom Sou5, OrangeTail, and RootRun malware onto vulnerable appliances. The U.S. Cybersecurity and Infrastructure Security Agency attributed these attacks to ransomware-affiliated threat groups.
Last month, SonicWall disclosed that attackers were chaining two additional zero-days (CVE-2026-83548 and CVE-2026-83549) to achieve remote code execution on SMA1000 gateways. Over the past four years, CISA has catalogued 19 SonicWall vulnerabilities as actively exploited in the wild, with 13 of those also appearing in ransomware campaigns.