SonicWall has fixed four vulnerabilities in SMA1000 models 6210, 7210 and 8200v. The most urgent, CVE-2026-102255, is a pre-authentication server-side request forgery flaw in Appliance WorkPlace. A remote unauthenticated attacker could make the appliance issue requests, reach internal functionality and perform unauthorised operations. SonicWall assigns it a CVSS score of 10.0. The vendor provides no workaround and says there is currently no evidence that the October vulnerabilities are being exploited. This is an urgent patch advisory, not confirmation of a breach or campaign. The appliance becomes a confused deputy The risk is not simply that an outside request reaches the gateway. The gateway can become the intermediary that sends another request from a more trusted position. Controls that assume the appliance is a legitimate source may therefore see the request differently from one arriving directly from the internet. SonicWall has not published the internal functions or destinations that can be reached in every deployment. The advisory also does not say that the unauthenticated path produces code execution. Defenders should not turn a maximum score into a broader claim than the evidence supports. Four flaws share one fixed release CVE-2026-102255 is the unauthenticated forward-proxy SSRF. CVE-2026-102256 is operating-system command injection. Under specific conditions, an authenticated administrator can execute arbitrary operating-system commands. CVE-2026-102257 is a post-authentication Zip Slip flaw in the Appliance Management Console that can result in remote code execution. CVE-2026-102258 is stored cross-site scripting. Under specific conditions, an authenticated administrator can store and potentially execute JavaScript in the Appliance Management…