SonicWall patches a third pre-auth SSRF flaw in SMA 1000 gateways this year

Of the four, CVE-2026-102255 is the only one an attacker can use with nothing more than network access to the portal ^[5]. The other three need a login, and two of them need an administrator's ^[7][8]. Help Net Security puts the root cause down to an unintended alternate access path in the Work Place interface ^[4].

The SSRF's reach could change that ordering. According to Help Net Security, it lets an unauthenticated attacker perform actions normally reserved for logged-in users or admins ^[5]. The report does not say whether those actions reach the code behind CVE-2026-102256, the command injection fixed in the same release ^[7]. If they do, the two bugs together would give an attacker with no credentials operating system commands on the gateway ^[13].

"There is currently no evidence any of the vulnerabilities addressed in this release are being exploited in the wild," SonicWall said ^[2]. This year's record for this bug class points the other way. Attackers exploited two earlier pre-authentication SSRF flaws in SMA 1000, CVE-2026-15409 and CVE-2026-83548, as zero-days in 2026 ^[3]. Counting this release, at least three pre-auth SSRFs in the product line have gone public this year, and two of them were exploited before a fix existed ^[12]. Help Net Security also notes that past reports show both SMA 1000 and SMA 100 appliances are regularly targeted ^[10].

That makes this a pattern of repeated attacks on one product line. One exploit would have been a one-off. The two earlier zero-days are public record. Whether anyone is already working on CVE-2026-102255 is not known, and SonicWall's statement covers only what the company has seen so far ^[2].

SMA 1000 boxes are SSL VPN gateways used by medium and large enterprises, managed security service providers and government agencies ^[11]. They sit at the network edge by design, and the vulnerable Work Place portal is the internet-facing one ^[5].