All vulnerabilities
CVE-2026-102255

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could p

SonicWall SMA1000Network & edge
Open in ThreatlineRecord JSON
CVSS
10.0Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.48%Chance of exploitation activity in the next 30 days, higher than 40% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published7 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Timeline

  1. 7 Oct 2026, 13:07 UTCPublishedCVE List
  2. 23 Oct 2026, 23:41 UTCExploit code publicGitHub proof-of-concept repositories

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.

Text from CVE List

Affected versions 2

  • SMA1000affected: 12.4.3-03526 (platform-hotfix) and older versionsCVE List
  • SMA1000affected: 12.5.0-02952 (platform-hotfix) and older versionsCVE List

References 1