SonicWall SMA 1000 Series Appliances Under Active Exploitation

SonicWall disclosed two zero-day vulnerabilities in its Secure Mobile Access (SMA) 1000 series—CVE-2026-15409 (critical SSRF, CVSS 10.0) and CVE-2026-15410 (code-injection, CVSS 7.2). The SSRF flaw allows an unauthenticated remote attacker to make the appliance issue requests to unintended locations, while the code-injection flaw lets a remote authenticated attacker, under certain conditions, execute arbitrary operating-system commands as an administrator. Both vulnerabilities affect the SMA6210, SMA7210, and SMA8200v models. SonicWall confirmed that the flaws are being exploited in the wild, often in tandem, and that multiple incidents have been observed.

SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410)Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin CommandsSonicWall Products Multiple Vulnerabilities

SonicWall’s product-security incident response team (PSIRT) announced that it had investigated “multiple cases indicating the active exploitation of the vulnerabilities” and released firmware hot-fixes (v12.4.3-03453 and 12.5.0-02835) on July 14, 2026. The company urged customers to apply the patches, re-image or redeploy affected appliances, rotate passwords, and reset TOTP tokens. It also offered a remediation script and case-by-case support. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the two CVEs to its Known Exploited Vulnerabilities (KEV) catalog and mandated that Federal Civilian Executive Branch agencies apply the fixes by July 17, 2026.

Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands

• “We have confirmed that these vulnerabilities are being actively exploited in the wild and are not unique to SonicWall,” — SonicWall spokesperson

SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410)

• “It is important that customers understand patching alone is not sufficient. Even after applying the update, we strongly recommend reviewing logs for indicators of compromise and following the guidance in our KB article closely,” — SonicWall spokesperson

SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410)

• “Our support team is assisting customers through instances of suspicious activity on a case-by-case basis.” — SonicWall spokesperson

SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410)

• “investigated multiple cases indicating the active exploitation of the vulnerabilities,” — Adam Babis, SonicWall PSIRT

Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands

CISA requires all U.S. federal civilian agencies to remediate the SMA 1000 flaws by July 17, 2026, and to verify whether any of their appliances have been compromised. SonicWall continues to expand its indicator-of-compromise (IOC) list with assistance from Volexity researchers Sean Koessel and Steven Adair, and it advises all customers—government, enterprise, and managed-service providers—to verify patch installation and monitor for residual malicious activity.

SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410)