SonicWall SMA1000 EUVD-2026-94327

Exploitation requires the attacker to already be authenticated to the SMA1000 Appliance Management Console (AMC) as an administrator, and the vendor notes it is possible only 'in specific conditions,' indicating it is not reliably triggerable in default/all states. Execution additionally requires a victim user to view the page containing the stored payload (UI:R). Limiting factors: highest-tier (administrator) authentication is the main barrier, meaning the attacker must already possess privileged access; impact is confined to the AMC management interface; and the vendor's 'specific conditions' caveat suggests non-default or particular configuration/input paths are needed.

This is a moderate-severity (CVSS 6.1) stored XSS confined to the SMA1000 Appliance Management Console, and the available signals converge on LOW real-world priority rather than an urgent threat. SSVC supports deprioritization: Exploitation=none, Automatable=no, Technical Impact=partial. Exploitation status is 'no public exploit identified at time of analysis' - not in CISA KEV and no POC referenced. No EPSS score was provided, so statistical exploitation likelihood cannot be factored in (data missing). A key CONFLICT exists: the NVD vector lists PR:N (unauthenticated), but the vendor description explicitly states 'post-authentication' and 'remote authenticated attacker as administrator.' This strongly implies the vector's PR:N is incorrect and that administrator-level authentication is actually required - verify with SonicWall advisory SNWLID-2026-0017. Because the attacker must already be an authenticated administrator, the vulnerability primarily enables one admin to attack another admin's session (or persistence/session abuse), sharply limiting realistic impact. Treat as a hardening/patch-in-maintenance-window item, not an emergency.

An attacker who already holds (or has compromised) administrator credentials to the SMA1000 AMC injects malicious JavaScript into a stored field; when another administrator later views that page in the AMC, the script executes in their authenticated browser session. No public exploit code is identified, and the limited C:L/I:L impact plus required administrator access and victim interaction make this a narrow, low-likelihood scenario.