// AI threat desk · 9 Oct 2026
Home/CVE · Vulns & Patches
Vulns & PatchesMediumPATCHCVSS 10

SonicWall and Splunk announced patches for flaws enabling code execution

SonicWall and Splunk announced patches for vulnerabilities that could enable arbitrary code execution. SonicWall disclosed no evidence of exploitation in the wild.

· 2 min read
AI-generated image of security analysts reviewing vulnerability dashboards beside network equipment in a dim operations centre.
AI-generated image, not a photo of the event.
Key takeaways
  • SonicWall and Splunk announced patches for multiple vulnerabilities, including flaws that could lead to arbitrary code execution.
  • SecurityWeek said SonicWall’s most severe vulnerability is a pre-authenticated SSRF flaw with a CVSS score of 10.
  • SonicWall said there is no evidence that the addressed vulnerabilities are being exploited in the wild.

SonicWall and Splunk announced patches for multiple vulnerabilities on Wednesday, including flaws that could lead to arbitrary code execution.

SecurityWeek said SonicWall’s most severe issue is a pre-authenticated SSRF vulnerability in SMA appliances with a CVSS score of 10. SonicWall said a remote unauthenticated attacker could direct an appliance to issue requests on the attacker’s behalf, reach internal functionality and perform unauthorized operations.

Splunk’s fixes cover Splunk Enterprise, MCP Server and the Add-on for Amazon Web Services. SecurityWeek said the Enterprise updates address bugs that could enable arbitrary command execution, unauthorized access and code injection.

On this page

SonicWall’s alternate access path could reach internal functionality

SecurityWeek said CVE-2026-102255 is a pre-authenticated SSRF vulnerability caused by an unintended alternate access path.

SonicWall said a remote unauthenticated attacker could potentially abuse the path to make the appliance issue requests and reach internal functionality.

SecurityWeek said the SonicWall updates also address two high-severity and one medium-severity vulnerability that could be exploited for remote code execution and cross-site scripting attacks.

Splunk patched Enterprise and MCP Server vulnerabilities

SecurityWeek said Splunk MCP Server received a patch for a medium-severity defect that could allow an authenticated user to modify API settings so requests go to an attacker-controlled URL.

Splunk said that in MCP Server versions below 1.2.1, a user with the `mcp_tool_admin` capability could configure a custom API tool to send requests to an attacker-controlled URL.

SonicWall said there is currently no evidence that the vulnerabilities addressed in its release are being exploited in the wild. It also said SSL-VPN running on SonicWall Firewall products is not affected.

ProductFixed version
Splunk MCP Server1.2.1 or higher
Splunk Enterprise10.4.3, 10.2.7, 10.0.10 or 9.4.15 or higher

What to do now

  1. Update SonicWall SMA1000 appliances to versions 12.5.0-03082 and 12.4.3-03670.
  2. Upgrade Splunk MCP Server to version 1.2.1 or higher.
  3. Upgrade Splunk Enterprise to versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15 or higher.

FAQ

What did SonicWall and Splunk announce on Oct 7, 2026?

SonicWall and Splunk announced patches for multiple vulnerabilities in their products, including flaws that could lead to arbitrary code execution.

What is CVE-2026-102255?

SecurityWeek described it as a pre-authenticated SSRF vulnerability caused by an unintended alternate access path. SecurityWeek gave the vulnerability a CVSS score of 10.

What could an attacker do with the SonicWall flaw?

SonicWall said a remote unauthenticated attacker could direct the appliance to issue requests on the attacker’s behalf, reach internal functionality and perform unauthorized operations.

Which Splunk MCP Server versions are affected?

Splunk said the MCP Server vulnerability affects versions below 1.2.1.

Were the SonicWall vulnerabilities exploited in the wild?

SonicWall said there is currently no evidence that the vulnerabilities addressed in its release are being exploited in the wild.

How should Splunk MCP Server users fix the issue?

Splunk says users of MCP Server versions below 1.2.1 should upgrade to version 1.2.1 or higher.

Sources

  1. Splunk Security Advisories Archive, SplunkPrimary
  2. SonicWall and Splunk Patch Critical Vulnerabilities, SecurityWeek
  3. SonicWall urges admins to patch critical RCE flaw in SMA 100 devices, BleepingComputer
  4. Sonicwall fixes critical flaw in SMA appliances, urges customers to check for compromise (CVE-2025-40599), Help Net Security
How we checked this story
ClaimSourceStatus
Splunk and SonicWall announced patches for multiple critical- and high-severity vulnerabilities in their products on Wednesday.SonicWall, via SecurityWeekAttributed
SecurityWeek said cVE-2026-102255 is a pre-authenticated SSRF vulnerability caused by an unintended alternate access path and has a CVSS score of 10.SecurityWeekAttributed
SonicWall said the alternate path could let a remote unauthenticated attacker make the appliance issue requests and reach internal functionality.SonicWall, via SecurityWeekAttributed
SecurityWeek said the SonicWall updates also address two high-severity and one medium-severity vulnerability that could enable remote code execution and cross-site scripting.SecurityWeekAttributed
SonicWall said there was no evidence that the addressed vulnerabilities were being exploited in the wild and that SSL-VPN on SonicWall Firewall products was unaffected.SonicWall, via SecurityWeekAttributed
Splunk announced fixes for dozens of security flaws in Splunk Enterprise, MCP Server, and the Add-on for Amazon Web Services.Splunk, via SecurityWeekAttributed
SecurityWeek said splunk Enterprise updates fix three critical-severity bugs that could enable arbitrary command execution, unauthorized access, and code injection.SecurityWeekAttributed
SecurityWeek said splunk MCP Server received a patch for a medium-severity defect that could let an authenticated user configure API requests to an attacker-controlled URL.SecurityWeekAttributed
Splunk says users unable to upgrade MCP Server should turn off or remove the Splunk MCP Server app.SplunkConfirmed

Could not verify

  • Whether the SonicWall vulnerabilities other than CVE-2026-102255 have assigned CVE identifiers is not established.
  • Whether the Splunk vulnerabilities were exploited in the wild is not established.
  • How many SonicWall and Splunk customers are affected is not established.
  • Whether the SonicWall and Splunk vulnerabilities are linked is not established.
cve
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok