Posted on

SonicWall SMA1000 CVE-2026-102255 Vulnerability Cluster Hunt

Threat Overview

SonicWall published SNWLID-2026-0017 for four vulnerabilities in physical and virtual SMA1000 appliances. The lead issue, CVE-2026-102255, is a CVSS 10.0 pre-authentication server-side request forgery flaw in the user-facing WorkPlace interface. SonicWall describes an unintended alternate access path that can cause the appliance to issue attacker-directed requests and reach internal functionality. The same update fixes post-authentication remote code execution (CVE-2026-102256), an administrator-only Zip Slip path traversal that can place files outside the extraction directory and lead to code execution (CVE-2026-102257), and administrator-only stored XSS in the Appliance Management Console (CVE-2026-102258).

SonicWall explicitly states that it has no evidence these vulnerabilities are being exploited in the wild. No exploit URI, proof of concept, attacker infrastructure, or CVE-specific IOC was published. Hunting must therefore remain behavior-based and is necessarily lower confidence than build validation and patching. The most useful Sentinel signals are unexpected proxy-like WorkPlace requests, SMA-originated access to loopback/link-local/private services, rare AMC administration, archive uploads, and anomalous appliance-to-internal or appliance-to-Internet connections.

References

Impacted Systems

  • Vendor/product: SonicWall Secure Mobile Access 1000 Series models 6210, 7210, and 8200v, including physical appliances and 8200v on all hypervisors.
  • Affected platform-hotfix builds: 12.4.3-03526 and earlier; 12.5.0-02952 and earlier.
  • Fixed builds: 12.4.3-03670 and later; 12.5.0-03082 and later.
  • Roles/interfaces: WorkPlace user portal for CVE-2026-102255; Appliance Management Console for the authenticated command-injection/RCE, Zip Slip, and stored-XSS issues.
  • Prerequisites: CVE-2026-102255 requires no authentication. CVE-2026-102256 requires authenticated access. CVE-2026-102257 and CVE-2026-102258 require an authenticated administrator.
  • Exposure: Internet-facing WorkPlace portals have the greatest pre-authentication risk. Internet-exposed AMC/SSH expands the post-authentication attack surface and should not be broadly reachable.
  • Explicitly unaffected: SonicWall states these vulnerabilities are unrelated to vulnerabilities in other SonicWall products; SMA 100 and firewall-hosted SSL-VPN are not listed as affected by this advisory.

Why this matters

SMA appliances sit at a high-trust remote-access boundary and commonly reach internal authentication and application services. A pre-authentication SSRF on that boundary can provide access that perimeter controls did not intend, while the authenticated flaws offer command execution and file-placement primitives after credential or administrative access. The absence of confirmed exploitation reduces confidence in behavioral signatures but does not reduce the urgency of build and exposure validation.

Exploitation Status

No confirmed active exploitation as of October 7, 2026. This is an explicit vendor statement. Earlier SMA1000 vulnerabilities have been exploited, but that history is not evidence that this new cluster has been exploited. No published exploit path or CVE-specific IOC exists for SNWLID-2026-0017, so generic SSRF or command-injection matches are hypotheses requiring validation against native appliance logs and network context.

What this hunt looks for

Affected SMA models and builds, proxy-like WorkPlace requests, internal or link-local server-side destinations, rare AMC administration, archive upload and traversal patterns, command metacharacters, new appliance egress after inbound requests, and SMA Syslog anomalies.

Required logs

Authoritative SMA1000 model and full platform-hotfix build inventory; WorkPlace and Appliance Management Console request logs; SMA Syslog; and firewall or flow telemetry in CommonSecurityLog that identifies appliance ingress, egress, NAT, and east-west destinations.

Hunt 1 — Inventory SMA models and build strings in available logs

let lookback = 30d;
union isfuzzy=true Syslog, CommonSecurityLog
| where TimeGenerated >= ago(lookback)
| extend Raw=tostring(pack_all())
| where Raw has_any ("SMA 6210", "SMA6210", "SMA 7210", "SMA7210", "SMA 8200v", "SMA8200v", "12.4.3-", "12.5.0-")
| extend Build=extract(@"\b(12\.(?:4\.3|5\.0)-\d{5})\b", 1, Raw)
| summarize LastSeen=max(TimeGenerated), Samples=make_set(substring(Raw, 0, 700), 5) by Computer=coalesce(column_ifexists("Computer", ""), column_ifexists("DeviceName", "")), Build
| order by LastSeen desc

Hunt 2 — Proxy-like WorkPlace requests targeting internal services

let lookback = 30d;
union isfuzzy=true CommonSecurityLog, AzureDiagnostics
| where TimeGenerated >= ago(lookback)
| extend Raw=tostring(pack_all()), Src=coalesce(column_ifexists("SourceIP", ""), column_ifexists("clientIp_s", ""), column_ifexists("CallerIPAddress", "")), Dst=coalesce(column_ifexists("DestinationIP", ""), column_ifexists("destinationIP_s", ""))
| extend Decoded=url_decode_component(url_decode_component(Raw))
| where Decoded has_any ("WorkPlace", "workplace")
| where Decoded matches regex @"(?i)(https?|file|gopher|dict)://(127\.0\.0\.1|localhost|169\.254\.169\.254|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)"
| project TimeGenerated, Src, Dst, Request=substring(Decoded, 0, 1800)
| order by TimeGenerated desc

Hunt 3 — Absolute URI or alternate-scheme syntax in SMA-bound requests

let lookback = 30d;
union isfuzzy=true CommonSecurityLog, AzureDiagnostics
| where TimeGenerated >= ago(lookback)
| extend Raw=tostring(pack_all()), Src=coalesce(column_ifexists("SourceIP", ""), column_ifexists("clientIp_s", ""), column_ifexists("CallerIPAddress", "")), DstHost=coalesce(column_ifexists("DestinationHostName", ""), column_ifexists("host_s", ""))
| extend Decoded=url_decode_component(url_decode_component(Raw))
| where Raw has_any ("SMA", "WorkPlace", "workplace")
| where Decoded matches regex @"(?i)(url|uri|target|dest|redirect|proxy|host)\s*[=:]\s*(https?|file|gopher|dict)[:%]"
| summarize Requests=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Destinations=make_set(DstHost, 10), Samples=make_set(substring(Decoded, 0, 700), 5) by Src
| order by Requests desc

Hunt 4 — SMA appliance connections to loopback, link-local, or sensitive internal ports

let lookback = 30d;
let sma_ips = dynamic(["REPLACE_WITH_SMA_IP"]);
CommonSecurityLog
| where TimeGenerated >= ago(lookback)
| where SourceIP in (sma_ips)
| where DestinationIP startswith "10." or DestinationIP startswith "192.168." or DestinationIP matches regex @"^172\.(1[6-9]|2[0-9]|3[01])\." or DestinationIP == "169.254.169.254" or DestinationIP == "127.0.0.1"
| where DestinationPort in (22, 80, 443, 445, 2375, 2376, 3306, 5432, 6379, 6443, 8080, 9200)
| summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Ports=make_set(DestinationPort, 20), Actions=make_set(DeviceAction, 10) by SourceIP, DestinationIP
| order by Connections desc

Hunt 5 — Rare or public-source AMC administrative access

let lookback = 30d;
union isfuzzy=true CommonSecurityLog, Syslog
| where TimeGenerated >= ago(lookback)
| extend Raw=tostring(pack_all()), Src=coalesce(column_ifexists("SourceIP", ""), extract(@"\b(?:src|source|client)[=: ]+(\d{1,3}(?:\.\d{1,3}){3})", 1, tostring(column_ifexists("SyslogMessage", ""))))
| where Raw has_any ("Appliance Management Console", "AMC login", "administrator login", "admin login")
| summarize Events=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Samples=make_set(substring(Raw, 0, 700), 5) by Src
| where isempty(Src) or ipv4_is_private(Src) == false
| order by LastSeen desc

Hunt 6 — Archive upload/import and traversal indicators in AMC traffic

let lookback = 30d;
union isfuzzy=true CommonSecurityLog, AzureDiagnostics, Syslog
| where TimeGenerated >= ago(lookback)
| extend Raw=tostring(pack_all()), Src=coalesce(column_ifexists("SourceIP", ""), column_ifexists("clientIp_s", ""))
| extend Decoded=url_decode_component(url_decode_component(Raw))
| where Decoded has_any ("AMC", "Appliance Management Console", "upload", "import", "archive")
| where Decoded has_any (".zip", "application/zip", "multipart/form-data")
    and Decoded has_any ("../", @"..\", "%2e%2e", "upload", "import")
| project TimeGenerated, Src, Evidence=substring(Decoded, 0, 1800)
| order by TimeGenerated desc

Hunt 7 — Command metacharacters in authenticated SMA administration traffic

let lookback = 30d;
union isfuzzy=true CommonSecurityLog, AzureDiagnostics, Syslog
| where TimeGenerated >= ago(lookback)
| extend Raw=tostring(pack_all()), Src=coalesce(column_ifexists("SourceIP", ""), column_ifexists("clientIp_s", ""))
| extend Decoded=url_decode_component(url_decode_component(Raw))
| where Decoded has_any ("AMC", "Appliance Management Console", "admin")
| where Decoded matches regex @"(?i)(;|\||&&|`|\$\(|%3b|%7c)(\s|%20)*(sh|bash|curl|wget|nc|python|perl|id|whoami)\b"
| project TimeGenerated, Src, Evidence=substring(Decoded, 0, 1800)
| order by TimeGenerated desc

Hunt 8 — Inbound request followed by new SMA-originated destination

let lookback = 30d;
let baseline = 14d;
let sma_ips = dynamic(["REPLACE_WITH_SMA_IP"]);
let Known = CommonSecurityLog
| where TimeGenerated between (ago(baseline) .. ago(1d))
| where SourceIP in (sma_ips)
| summarize by SourceIP, DestinationIP, DestinationPort;
let RecentInbound = CommonSecurityLog
| where TimeGenerated >= ago(1d)
| where DestinationIP in (sma_ips)
| summarize InboundTime=min(TimeGenerated), InboundSources=make_set(SourceIP, 20) by ApplianceIP=DestinationIP, bin(TimeGenerated, 10m);
CommonSecurityLog
| where TimeGenerated >= ago(1d)
| where SourceIP in (sma_ips)
| join kind=leftanti Known on SourceIP, DestinationIP, DestinationPort
| join kind=inner RecentInbound on $left.SourceIP == $right.ApplianceIP
| where TimeGenerated between (InboundTime .. InboundTime + 30m)
| project TimeGenerated, ApplianceIP=SourceIP, DestinationIP, DestinationPort, DeviceAction, InboundTime, InboundSources
| order by TimeGenerated desc

Hunt 9 — SMA Syslog authentication, configuration, and service anomalies

let lookback = 30d;
Syslog
| where TimeGenerated >= ago(lookback)
| where SyslogMessage has_any ("SMA", "WorkPlace", "AMC", "Secure Mobile Access") or ProcessName has_any ("aventail", "sma")
| where SyslogMessage has_any ("login failed", "authentication failed", "administrator", "configuration changed", "service restarted", "unexpected", "segmentation", "command", "upload", "import")
| summarize Events=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Messages=make_set(SyslogMessage, 10) by Computer, HostName, ProcessName, SeverityLevel
| order by LastSeen desc

Detection Notes

  • Build validation and patching are more reliable than these behavioral hunts because SonicWall published no exploit path or CVE-specific IOC.
  • Hunt 4 and Hunt 8 require the exact appliance IP list. Leaving REPLACE_WITH_SMA_IP unchanged intentionally returns no useful scope and prevents accidental broad matching.
  • Generic SSRF, traversal, and command metacharacters can appear in scanners and legitimate encoded data. Confirm the destination is an affected SMA1000 and validate native appliance events before escalation.
  • A WorkPlace request can be visible at a perimeter device while the server-side destination is not. East-west flow or appliance egress telemetry is needed to determine whether an internal request occurred.
  • AMC should rarely be reachable from the public Internet. Public-source administration is high-value even when it does not match a published CVE behavior.
  • NAT may cause the appliance’s outbound traffic to appear under another source address. Use firewall session/NAT fields or the native network platform to recover the pre-NAT source.
  • No finding from these hunts can disprove exploitation when raw request URIs, appliance Syslog, or east-west connections are not ingested.