Which products and versions are affected?
SonicWall notice SNWLID-2026-0017 covers SMA 1000 models 6210, 7210 and 8200v, including the listed virtual platforms. The notice identifies CVE-2026-102255 as a server-side request forgery vulnerability with a CVSS score of 10.0. Check the complete advisory for the other vulnerabilities covered by the same hotfixes.
| Firmware branch | Affected platform-hotfix versions listed by SonicWall | Fixed platform-hotfix versions listed by SonicWall |
|---|---|---|
| 12.4.3 | 12.4.3-03526 and older | 12.4.3-03670 and higher |
| 12.5.0 | 12.5.0-02952 and older | 12.5.0-03082 and higher |
These are branch-specific version ranges from the vendor notice, not instructions to install a package intended for a different product. The earlier version of this article incorrectly listed firmware 1.0.0–1.2.3 and a 1.2.4 fix. Those numbers do not match this advisory.
What is confirmed about exploitation?
The vendor notice was published on 5 October 2026 and last updated on 6 October. At that point, it reported no evidence of exploitation. That dated statement should not be treated as a description of every later observation.
The original Dark Reading report dated 12 October attributes later honeypot observations to security vendors. We have not independently reproduced an exploit or verified those vendors' original sensor records. A sensor report is also different from a confirmed compromise of a customer's production appliance. Consult current vendor advisories and incident evidence before describing exploitation in a particular environment.
What should an administrator check?
- Identify the exact appliance model, firmware branch and platform-hotfix build.
- Compare that build with the affected and fixed versions in the current vendor notice.
- Obtain the applicable hotfix through the official SonicWall channel and follow its installation and recovery instructions.
- Review exposure and logs using the vendor's guidance and your incident-response process. A successful update alone does not establish whether a device was previously compromised.
This article does not provide a tested detection rule or a verified exploit endpoint. Earlier descriptions of a specific /config request, plaintext credential retrieval and an exact attack sequence lacked supporting primary evidence and have been removed.
Correction, 1 November 2026: Corrected the affected and fixed firmware versions, removed unsupported exploit details, and separated the dates and limits of exploitation claims. The original publication date, URL and image are preserved. This correction does not claim that exploitation has been disproved.