SonicWall SMA1000: Check the Hotfix and the Earlier Exposure
SonicWall’s SMA1000 hotfix addresses four different weaknesses, including a pre-login route that can send requests towards internal functionality. Verify the complete running build, then review what happened before remediation. A corrected version and an assessment of earlier access answer different questions.
Update, 13 October 2026: On 6 October, SonicWall reported no evidence of exploitation. On 9 October, the Canadian Centre for Cyber Security updated its notice to say open-source reporting indicated exploitation of CVE-2026-102255.
Update, 16 October 2026, 00:34 CEST: Previdian showed 616 attempts from five IPs across two sensors, including 439 on 15 October. The 13 October snapshot was 135 attempts, two IPs, one sensor, last activity 10 October. These are sensor events, not successful compromises or victims; they do not identify a single actor.
Update, 31 October 2026: The same Previdian page displayed 2,387 attempts, seven distinct source IPs and two sensors, with activity last seen on 28 October. Its chart covers 24 days. This is a dated sensor observation, not a directly comparable measure of growth against the earlier snapshots. It does not count victims, establish successful entry or identify a single actor.
Patch the exact platform-hotfix branch
The affected products are SMA1000 models 6210, 7210 and 8200v. SonicWall lists builds 12.4.3-03526 and earlier, and 12.5.0-02952 and earlier, as affected. The fixed destinations are 12.4.3-03670 or later and 12.5.0-03082 or later.
Source check, 31 October 2026: The original CVE records list the affected ranges without explicit fixed-version entries. The Canadian notice currently uses SonicWall’s fixed endpoints with “and prior” in its affected list. That differs from the vendor’s affected and fixed tables. Use the product-specific SonicWall matrix above for release selection, while retaining the Canadian centre’s separately attributed exploitation warning.
The pre-authentication SSRF in Appliance WorkPlace can make an unauthenticated attacker’s requests reach internal functions. SonicWall rates it 10.0 and offers no workaround. SMA 100 Series and firewall SSL-VPN are outside this advisory.
The same release also fixes three post-authentication issues with different effects. For CVE-2026-102256, SonicWall’s description concerns an authenticated administrator executing operating-system commands under specific conditions. Its published CVSS v3.0 vector nevertheless uses local access and low privileges. Keep both source qualifications visible; this does not establish a pre-login remote-code-execution path.
CVE-2026-102257 concerns Zip Slip in the Appliance Management Console. A crafted archive can extract files outside the intended directory and result in code execution. SonicWall labels it post-authentication and publishes a high-privilege vector.
CVE-2026-102258 is stored cross-site scripting in that management console. The vendor describes an authenticated administrator storing and potentially executing JavaScript under specific conditions. Do not collapse these four identifiers into one unauthenticated remote-code-execution chain.
What the telemetry changes
Keep the evidence from before maintenance separate from the checks performed afterwards. Name who reviewed each record and what remains unknown.
Turn the patch into a controlled response
- Inventory every appliance. Include standby, disaster-recovery and lab systems, then record the complete platform-hotfix string.
- Prioritise internet exposure. Patch exposed systems first and restrict administrative reachability to the smallest practical set of trusted paths.
- Preserve the exposure timeline. Record when the appliance became reachable, when the fixed build was installed and which telemetry remains available for that interval.
- Review behaviour, not only logins. Look for unusual outbound requests, administrator activity, configuration changes and downstream access originating from the gateway.
- Escalate evidence, not headlines. If local records indicate unauthorised access or alteration, move into incident response and scope the systems and credentials reachable from the appliance.
- Verify after change. Confirm the running build, repeat the exposure check and keep evidence from before the upgrade separate from post-upgrade validation.
For historical background, read BlackTree’s earlier SMA1000 reporting.
The BlackTree view
Keep two reviewable records: the running build and the evidence assessment. Give each a named owner, a verification time and a route for unresolved questions.
