SonicWall SMA 1000 Zero-Days Exploited in the Wild: CVE-2026-15409/15410 Emergency Patch Advisory

Two zero-days in SonicWall SMA 1000 SSL VPN appliances are under active exploitation: CVE-2026-15409 (SSRF, CVSS 10.0) and CVE-2026-15410 (code injection, CVSS 7.2). CISA added both to the KEV catalog.

Incident Overview

In July 2026, SonicWall issued an emergency advisory confirming two zero-days in Secure Mobile Access (SMA) 1000 series appliances—CVE-2026-15409 and CVE-2026-15410—both actively exploited in the wild. CISA added both to the Known Exploited Vulnerabilities (KEV) catalog and required U.S. civilian federal agencies to patch or mitigate by 17 July 2026.

After investigating multiple intrusions, SonicWall confirmed attackers typically chain the two flaws: unauthenticated SSRF first to expand the attack surface, then authenticated code injection to run arbitrary OS commands and fully control the VPN gateway.

Vulnerability Details

CVE-2026-15409: Server-Side Request Forgery (SSRF)

CVSS v3.1 10.0 (Critical)

Vulnerability type Server-Side Request Forgery (SSRF)

Affected component SMA1000 Appliance Work Place interface

Authentication None required

Attack vector Network-reachable, low complexity

Unauthenticated remote attackers can force the SMA1000 to send requests to unintended internal or external locations. SSRF bypasses network isolation, scans internal services, hits internal APIs, and can complete an RCE chain when combined with other bugs.

CVE-2026-15410: Code Injection

CVSS v3.1 7.2 (High)

Vulnerability type Code Injection

Affected component SMA1000 Appliance Management Console (AMC)

Authentication Administrator privileges required

Attack vector Network-reachable, post-auth

Lives in the management console. A remote attacker with admin credentials can inject and execute arbitrary OS commands and take over the device. SonicWall says observed attacks often combine both flaws.

Affected Products

• Appliance models: SMA 6210, SMA 7210, SMA 8200v
• Affected firmware versions:
• 12.4.3-03245, 12.4.3-03387, 12.4.3-03434 (platform-hotfix)
• 12.5.0-02283, 12.5.0-02624, 12.5.0-02800 (platform-hotfix)

Note: Does not affect SSL-VPN on SonicWall firewalls, nor the SMA 100 product line.

Technical Mechanism and Attack Scenarios

SMA 1000 series devices are enterprise SSL VPN remote-access gateways, widely deployed in mid-to-large enterprises, multinationals, and government. Compromise of this internet-edge infrastructure lets an attacker:

• Use SSRF to scan and reach assets behind the VPN
• Gain root/shell on the VPN appliance via code injection
• Steal credentials and session data traversing the VPN tunnel
• Plant persistence and monitor remote-access traffic long-term
• Pivot from the VPN gateway into the core internal network

Intrusion Detection Indicators

SonicWall recommends checking these logs and system state for compromise:

• Requests to /api/login or /api/logout in extraweb_access.log with HTTP status 200
• Unknown user accounts not created by administrators
• Unexpected management-console config changes
• Anomalous source IPs or access-time patterns in VPN session logs

Remediation

Upgrade immediately

SonicWall released security hotfixes. Affected users should upgrade now:

• 12.4.x branch: 12.4.3-03453 or later
• 12.5.x branch: 12.5.0-02835 or later

Patch download: SonicWall PSIRT SNWLID-2026-0008

SonicWall: patching alone is not enough

SonicWall stresses that applying the patch does not fully clear risk. Because these bugs are exploited in the wild, admins must also investigate for compromise. Recommended steps:

• Review all admin accounts; remove any suspicious or unknown accounts
• Rotate all admin passwords and TOTP tokens
• Check VPN user session logs for anomalous logins
• If compromise is confirmed, re-image the appliance rather than patch only
• Hunt threats on internal systems accessed through this VPN

Temporary mitigations

Until patches are deployed:

• Restrict SMA1000 management-interface access by source IP at the perimeter firewall
• Disable or restrict external access to the Work Place interface
• Enable MFA on all admin accounts
• Monitor extraweb_access.log for anomalous API requests
• Alert in SIEM on unexpected source IPs hitting VPN management ports

References

• SonicWall PSIRT advisory SNWLID-2026-0008
• CISA Known Exploited Vulnerabilities catalog
• BleepingComputer: SonicWall SMA1000 zero-days exploited
• Singapore Cyber Security Agency CSA AL-2026-088