# SonicWall SMA1000 SSRF chain enables RCE

Published: 2026-10-12 · Severity: routine · Sectors: technology
Canonical: https://vorant.io/reports/b4d9fc64-478d-5c41-b839-5acbee1c0fc8/sonicwall-sma1000-ssrf-chain-enables-rce

> Pre-auth SSRF in SonicWall SMA1000 WorkPlace interface could chain with post-auth command injection for full remote code execution; no exploitation observed yet.

MS-ISAC/CIS published an advisory detailing four vulnerabilities in SonicWall SMA1000 Series SSL VPN appliances (models 6210, 7210, 8200v) running 12.4.3-03526 and 12.5.0-02952 or earlier. The most severe, CVE-2026-102255, is a pre-authentication server-side request forgery in the WorkPlace interface caused by an unintended alternate access path, allowing an unauthenticated remote attacker to make the appliance issue requests on their behalf and reach internal functionality.

Three lower-severity, post-authentication flaws were also disclosed: CVE-2026-102256, an OS command injection allowing an authenticated admin to execute arbitrary commands and achieve RCE; CVE-2026-102257, a Zip Slip/path traversal issue enabling writes outside intended directories; and CVE-2026-102258, a stored XSS vulnerability. The advisory notes that chaining the unauthenticated SSRF with the post-auth command injection could allow an attacker to achieve full remote code execution and system compromise without prior credentials.

No in-the-wild exploitation has been reported at time of publication. Given SMA1000 appliances are internet-facing VPN/remote-access gateways, defenders should prioritize patching per SonicWall's updates, restrict administrative interface exposure, and monitor for anomalous WorkPlace interface requests indicative of SSRF probing.

## Mentioned in this report

- Vulnerabilities: CVE-2026-102255, CVE-2026-102256, CVE-2026-102257, CVE-2026-102258

## Detection guidance (public sample)

### SSRF Probing Against SonicWall SMA WorkPlace Interface

ATT&CK: T1190

Detects requests to the SMA WorkPlace interface whose query string carries internal, loopback, cloud-metadata or non-HTTP scheme targets, which is typical of SSRF probing such as the pre-auth SSRF in the SMA1000 chain. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SSRF Probing Against SonicWall SMA WorkPlace Interface
status: experimental
description: Detects web requests to the SonicWall SMA WorkPlace interface where the
  query string contains loopback, link-local/cloud metadata, or non-HTTP scheme targets.
  This is a generic SSRF probing pattern, relevant to the pre-authentication SSRF
  in the SMA1000 chain (CVE-2026-102255). The exact vulnerable endpoint is not public
  in the advisory, so this matches on the WorkPlace path plus SSRF-style targets.
  Requires web or reverse-proxy logs in front of the appliance.
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-sonicwall-sma1000-series-appliances-could-allow-for-remote-code-execution_2026-113
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains: /workplace
  selection_ssrf:
    cs-uri-query|contains:
    - 127.0.0.1
    - localhost
    - 169.254.169.254
    - '[::1]'
    - file://
    - gopher://
    - dict://
    - ldap://
  condition: selection_path and selection_ssrf
fields:
- c-ip
- cs-uri-stem
- cs-uri-query
- sc-status
falsepositives:
- Vulnerability scanners or authorised penetration tests run against the SMA appliance
- Legitimate WorkPlace bookmarks or portal apps that reference localhost or internal
  URLs in query parameters
level: medium
id: 3ba0d345-918a-52a5-b12a-07653cca46a4
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-sonicwall-sma1000-series-appliances-could-allow-for-remote-code-execution_2026-113

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b4d9fc64-478d-5c41-b839-5acbee1c0fc8/sonicwall-sma1000-ssrf-chain-enables-rce.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup