CVE-2026-102255CWE-441CWE-918ssrf

CVE-2026-102255

Critical · published October 7, 2026

CVSS v3.1
10.0
EPSS
0%
Percentile
40.2
In the wild
Unconfirmed
What it is

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00477 · 40.2th percentile
Weaknesses
CWE-441 · Unintended Proxy or Intermediary ('Confused Deputy'); CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-10-07T17:17Z
References (1)
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017 · [email protected]
EPSS history
Timeline
  • 09 OCT 03:26Z
    EPSS moved — → 0%
    epss
  • 07 OCT 13:07Z
    A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path
    cvelistv5