SonicWall Fixes Max Severity Pre-Auth Flaw in SMA1000 Appliances

SonicWall issued hotfixes for a critical pre-authentication SSRF in SMA1000 appliances (CVE-2026-102255, CVSS 10.0) that could allow unauthenticated attackers to reach internal functions and perform unauthorized operations; three additional authenticated vulnerabilities (an OS command injection, a Zip Slip leading to RCE, and a stored XSS) were also patched. The vendor reports no evidence of exploitation for this CVE, but warns there is no workaround and notes earlier SMA1000 zero-days were actively exploited, recommending immediate application of available hotfixes via MySonicWall.