SonicWall Patches 4 SMA1000 Flaws, Including Critical Pre-Auth SSRF Rated CVSS 10

What happened?

SonicWall has patched four vulnerabilities in its Secure Mobile Access (SMA) 1000 Series appliances, including a critical server-side request forgery (SSRF) flaw with a maximum CVSS score of 10.0. The bug could let a remote attacker without valid credentials make the appliance send requests on their behalf, reach internal functions, and perform unauthorized operations. The company published security advisory SNWLID-2026-0017 on October 6, 2026. SonicWall said it currently has no evidence that any of these four vulnerabilities are being exploited in the wild.

Key details

• Post-authentication command injection (CVE-2026-102256, CVSS 7.8) lets authenticated admins execute arbitrary OS commands under specific conditions.
• Stored XSS in AMC (CVE-2026-102258, CVSS 5.5) enables authenticated admins to store and execute arbitrary JavaScript under specific conditions.
• SonicWall has no evidence of exploitation in the wild but strongly advises installing fixed software releases.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.