CVE-2026-102255

State: Published
Severity: 10.0 Critical
Published: Oct 7, 2026
Updated: Oct 7, 2026
Reserved: Sep 28, 2026

Description

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.

Scores

CVSS	Score	Vector	Source
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-918 Server-Side request forgery (SSRF)
CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')

Affected Products

Product	Versions
SMA1000SonicWall	12.4.3-03526 (platform-hotfix) and older versionsAffected 12.5.0-02952 (platform-hotfix) and older versionsAffected

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.