SonicWall SMA1000 Gets a Maximum-Severity Fix: Spec Sheet and Patch Checklist for Remote Access Gateways
SonicWall has shipped hotfixes for a maximum-severity, no-login-required SSRF flaw in its SMA1000 remote access appliances. Here are the key facts on one page, plus a checklist for admins.
Remote access gateways sit right on the edge of the network, and SonicWall’s SMA1000 line has had a rough year. The company has now released hotfixes for another flaw in these appliances, this one rated at the top of the severity scale. It isn’t known to be exploited yet. Given how often attackers have gone after this product family in 2026, that is a reason to move quickly, not to wait.
The flaw at a glance
- Identifier: CVE-2026-102255
- Type: Server-side request forgery (SSRF), caused by an unintended alternate access path
- Severity: Maximum
- Where it lives: The Appliance WorkPlace interface
- Affected models: SMA1000 6210, 7210 and 8200v, physical or virtual
- Not affected: The SMA 100 Series and the SSL-VPN built into SonicWall firewalls
- Who can exploit it: A remote attacker with no credentials, using a low-complexity attack
- What an attacker could do: Make the appliance send requests on the attacker’s behalf, reach internal functions and carry out unauthorized actions
- Fix: Hotfixes released Tuesday, October 6
- Exploited in the wild? SonicWall says there is currently no evidence of that
- Exposure: The Shadowserver Foundation sees more than 400 SMA1000 appliances reachable from the internet, though some may already be patched
Why this product line draws attackers
The SMA1000 is an enterprise-grade secure remote access gateway. Government agencies, managed service providers and large companies use it to give staff VPN access to internal applications. That makes it a valuable foothold, and this year’s record shows it:
- July: Two zero-days (CVE-2026-15409 and CVE-2026-15410) were exploited for weeks to plant custom malware known as Sou5, OrangeTail and RootRun. CISA linked those attacks to ransomware gangs.
- September: SonicWall warned that attackers were chaining two more zero-days (CVE-2026-83548 and CVE-2026-83549) to run code remotely on SMA1000 gateways.
- The long view: In the last four years CISA has added 19 SonicWall vulnerabilities to its catalog of actively exploited flaws, and 13 of them have been used in ransomware attacks.
Sergiu Gatlan reported the advisory and the appliance’s recent history for BleepingComputer.
Admin checklist
- Confirm whether you run an SMA1000 6210, 7210 or 8200v, including virtual instances someone may have stood up and forgotten.
- Apply SonicWall’s fixed release for your model now, using the version SonicWall lists in its advisory.
- While you’re in there, check that the patches for this year’s earlier SMA1000 zero-days are installed too.
- Limit who can reach the appliance’s interfaces from the internet wherever your setup allows it.
- Review appliance logs for unusual requests and any configuration changes you can’t explain.
- If you rely on a managed service provider for remote access, ask them directly whether your gateway is patched and when it was done.
What this means for your company
Remote access appliances are among the most heavily targeted devices any business owns, because one weak spot can open the whole network. Treat them like front doors. Know exactly which ones you have, keep them on a short patch cycle, and make sure someone is watching their logs. A flaw that isn’t exploited today often is a few weeks later, and the companies that patched early are the ones that don’t end up in incident reports.
Need help patching or hardening your VPN and remote access gateways? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
