SonicWall Product Security Update Advisory
Overview
SonicWall has released a security update that addresses several vulnerabilities in the SMA1000 product line. Users of these products should update to the latest version.
Affected Products and Versions
- SMA1000 6210, 7210, 8200v.
- Version 12.4.3-03526 (Platform-hotfix) and earlier.
- Version 12.5.0-02952 (Platform-hotfix) or earlier.
Resolved Vulnerabilities
- CVE-2026-102255: A server-side request forgery (SSRF) vulnerability—where a server is exploited to send external requests on behalf of the attacker—occurring through an unintended forward proxy in SMA1000 products.
- CVE-2026-102256: A post-authentication remote code execution (RCE; a vulnerability that allows arbitrary code to be executed remotely) vulnerability in the SMA1000 product.
- CVE-2026-102257: A post-authentication path traversal vulnerability occurring during the process of decompressing a compressed file in the SMA1000 product.
- CVE-2026-102258: A post-authentication stored cross-site scripting (XSS; a vulnerability where malicious scripts are stored on a web page) vulnerability in the SMA1000 product.
Versions with Patches
- CVE-2026-102255, CVE-2026-102256, CVE-2026-102257, For CVE-2026-102258, SMA1000 6210, 7210, and 8200v models must be updated to version 12.4.3-03670 (Platform-hotfix) or later.
- To address the same vulnerabilities, the SMA1000 6210, 7210, and 8200v models must be updated to version 12.4.3-03670 (Platform-hotfix) or later.
Note
- Security Advisory: https://psirt.Global.Sonicwall.Com/vuln-detail/SNWLID-2026-0017.
