Loading story…
SonicWall released fixes for four vulnerabilities in SMA 1000 remote access appliances, led by CVE-2026-102255, a critical pre-authentication server-side request forgery and unintended proxy flaw in the Work Place interface. An unauthenticated attacker with network access to that interface could make the appliance issue requests on their behalf, access internal functionality, and perform unauthorized operations without user interaction. The updates also address post-authentication OS command injection, administrator-authenticated path traversal, and administrator-authenticated cross-site scripting. Affected models are 6210, 7210, and 8200v; SonicWall firewall SSL-VPN functionality and SMA 100 Series devices are unaffected.
Organizations should upgrade affected appliances to 12.4.3-03670 or later or 12.5.0-03082 or later. Releases 12.4.3-03526 and earlier and 12.5.0-02952 and earlier remain vulnerable, including the previously patched 12.5.0-02952 build. SonicWall reported no evidence of exploitation of these four flaws, and no public proof of concept was known at publication, but two earlier pre-authentication SSRF vulnerabilities in SMA 1000 were reportedly exploited as zero-days in 2026. Pending patching, organizations should restrict Work Place access, isolate the Appliance Management Console, and monitor for suspicious activity.
Map this exposure pattern across your cloud, code, and identities.
5 events from the most recent confirmed update back to the earliest known activity.
SonicWall disclosed an unintended alternate access path in the SMA1000 Work Place interface that allows unauthenticated attackers to make the appliance issue requests, reach internal functionality, and perform unauthorized operations. Models 6210, 7210, and 8200v are affected, including the previously patched 12.5.0-02952 build.
CISA added CVE-2026-83548 and CVE-2026-83549 to its Known Exploited Vulnerabilities catalog.
SonicWall disclosed Work Place SSRF vulnerability CVE-2026-83548 and post-authentication command injection vulnerability CVE-2026-83549 as actively exploited zero-days. Attackers chained the flaws to achieve unauthenticated remote code execution.
An earlier server-side request forgery vulnerability in the SonicWall SMA1000 Work Place interface was disclosed after being exploited as a zero-day.
SonicWall released platform hotfixes 12.4.3-03670 and 12.5.0-03082 to address CVE-2026-102255 and three additional command injection, path traversal, and cross-site scripting vulnerabilities. SonicWall reported no evidence of exploitation of the four flaws and stated that firewall SSL-VPN functionality and SMA 100 Series devices were unaffected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
4 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourceacn.gov.it
Open sourcelabs.beazley.security
Open sourcepsirt.global.sonicwall.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SonicWall has patched two vulnerabilities that are being actively exploited against **SMA 1000 Series** appliances, affecting models including **6210, 7210, and 8200v**. The flaws, tracked as **`CVE-2026-15409`** and **`CVE-2026-15410`**, impact multiple **12.4.3** and **12.5.0** platform-hotfix releases. SonicWall described `CVE-2026-15409` as a **critical unauthenticated SSRF** issue in the Appliance Work Place interface and `CVE-2026-15410` as a **high-severity code injection** flaw in the Appliance Management Console that can allow an authenticated administrator to execute arbitrary operating system commands. SonicWall said the vulnerabilities have been exploited together in the wild and released hotfixes to address them. Government and vendor advisories urged organizations to update immediately and investigate appliances for signs of compromise, warning that patching alone may not be sufficient if an appliance has already been breached. SonicWall recommended reviewing logs, re-imaging or re-deploying affected systems where indicators are found, changing user and administrator passwords, and resetting TOTP tokens. The **Canadian Centre for Cyber Security** highlighted the advisory, and **CISA** added both vulnerabilities to its **Known Exploited Vulnerabilities** catalog the same day, underscoring the urgency for defenders to remediate exposed SMA1000 deployments.
Aug 25, 2026
SonicWall disclosed active exploitation of two vulnerabilities in **SMA1000-series SSL VPN appliances**: `CVE-2026-83548`, a critical pre-authentication server-side request forgery (SSRF) flaw with a CVSS score of 10.0, and `CVE-2026-83549`, a high-severity post-authentication OS command-injection flaw. The SSRF issue stems from an unintended forward-proxy access path in the Work Place interface and may enable unauthenticated attackers to reach internal resources or potentially execute commands; the command-injection flaw enables authenticated administrators to run arbitrary operating-system commands through the Appliance Management Console. SonicWall has issued hotfix firmware and urged customers to apply it immediately. Organizations operating affected appliances should restrict access to the Work Place and administrative interfaces, monitor appliances for anomalous outbound connections, and review administrator activity and appliance logs for indicators of compromise.
Sep 8, 2026
SonicWall has released urgent patches for a local privilege escalation vulnerability (CVE-2025-40602) in its Secure Mobile Access (SMA) 1000 appliances, following reports of active exploitation in the wild. Attackers have been chaining this flaw with a previously patched deserialization vulnerability (CVE-2025-23006) to achieve unauthenticated remote code execution with root privileges on affected devices. The vulnerabilities impact the Appliance Management Console (AMC) and Central Management Console (CMC), and SonicWall has advised customers to upgrade to the latest hotfix versions and restrict management interface access to mitigate risk. Security advisories from multiple sources, including government agencies and SonicWall itself, emphasize the criticality of patching due to the widespread use of SMA1000 appliances in large enterprises and critical infrastructure. Over 950 internet-exposed SMA1000 devices have been identified, heightening concerns about potential exploitation. No indicators of compromise have been released, but organizations are urged to apply the fixes immediately and review their exposure to the AMC and SSH interfaces to prevent further attacks.
Jul 23, 2026