CVE-2026-102255: SonicWall SMA1000 pre-auth SSRF rated CVSS 10.0

SonicWall disclosed CVE-2026-102255, a CVSS 10.0 pre-authentication SSRF in the WorkPlace interface of SMA1000 appliances (SMA 6210, 7210, 8200v). Exploitation attempts were observed roughly 24 hours after disclosure; fixes ship in firmware 12.4.3-03670 and 12.5.0-03082, with no workaround available.

• CVSS 10.0: unauthenticated remote SSRF via the WorkPlace interface
• In-the-wild exploitation attempts seen ~24 hours after disclosure
• Vulnerable: firmware 12.4.3-03526 and 12.5.0-02952 and older
• Fixed in 12.4.3-03670 and 12.5.0-03082; no workaround exists