Critical SSRF and RCE Vulnerabilities Discovered in SonicWall SMA1000 Series Appliances (CVE‑2026‑102255‑102258)
What Happened — Researchers disclosed four vulnerabilities in SonicWall SMA1000 Series SSL‑VPN gateways. The most severe is an unauthenticated server‑side request forgery (CVE‑2026‑102255) that can be chained with a post‑authentication OS command injection (CVE‑2026‑102256) to achieve remote code execution and full system compromise. Additional flaws include a Zip‑Slip path traversal and stored XSS.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability‑management controls that capture patch status and evidence of remediation.
- Highlights the importance of a defensible audit trail showing timely application of vendor hot‑fixes for network‑edge devices.
- Aligns with the control objective of “Secure Configuration & Vulnerability Management,” which satisfies multiple frameworks (e.g., NIST CSF, ISO 27001) through a single evidence set.
Who Is Affected — Large and medium enterprises, government agencies, and service providers that deploy SonicWall SMA1000 appliances for remote access.
Recommended Actions
- Verify appliance firmware version against the affected list and apply the latest hot‑fixes (12.4.3‑03526 or newer, 12.5.0‑02952 or newer).
- Integrate appliance patch status into your continuous control‑monitoring platform to generate real‑time compliance evidence.
- Document remediation steps in your control repository to support audit readiness. Source: CIS Advisory 2026‑113
Technical Notes
- Attack vector: pre‑auth SSRF → internal function access; can be chained with post‑auth OS command injection for RCE.
- CVEs: 2026‑102255 (SSRF), 2026‑102256 (command injection), 2026‑102257 (Zip‑Slip), 2026‑102258 (stored XSS).
- No known exploitation in the wild at time of publication. Source: CIS Advisory 2026‑113