SonicWall’s latest critical flaw indicates a security pattern, not another one-off bug
SonicWall has disclosed yet another critical flaw in one of its core products. CVE-2026-102255 , rated 10 in severity, the highest possible on the Common Vulnerability Scoring System (CVSS), is a pre-authentication server-side request forgery (SSRF) vulnerability in the SMA1000…
Aucun autre média suivi par Zonactu ne rapporte encore cette info.
The newly-disclosed maximum severity vulnerability, CVE-2026-102255, impacts SMA 1000 Models 6210, 7210, and 8200v running software versions 12.4.3-03526 and 12.5.0-02952 and earlier. The company said the vulnerabilities do not impact SSL-VPN running on SonicWall firewalls or the SMA 100 Series product line. Customers can download the latest platform-hotfix from mysonicwall.com.
The three other vulnerabilities disclosed by SonicWall this week include the 7.8-rated CVE-2026-102256 , which could allow a remote authenticated attacker to take over as admin and execute arbitrary OS commands; the 7.2-rated CVE-2026-102257 that could enable path traversal and remote code execution (RCE); and the 5.5-rated CVE-2026-102258 , which in “specific conditions” could give a remote authenticated attacker the ability to store and potentially execute arbitrary JavaScript code in the appliance management console.
SonicWall credited researchers from Anthropic, Trend Micro (through the Zero Day Initiative), and DigitalCanion SA for discovering the flaws.
