{"id":898,"date":"2026-07-15T11:31:50","date_gmt":"2026-07-15T06:01:50","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=898"},"modified":"2026-08-19T11:35:53","modified_gmt":"2026-08-19T06:05:53","slug":"sonicwall-sma1000-zero-day-cve-2026-15409-cve-2026-15410","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/sonicwall-sma1000-zero-day-cve-2026-15409-cve-2026-15410\/","title":{"rendered":"SonicWall SMA1000 Zero-Day: Patch CVE-2026-15409 & CVE-2026-15410"},"content":{"rendered":"

Introduction<\/h2>\n

The SonicWall SMA1000 zero-day vulnerabilities, CVE-2026-15409 and CVE-2026-15410, are being actively exploited, prompting SonicWall to release security hotfixes for affected Secure Mobile Access (SMA) 1000 appliances. These internet-facing systems are commonly deployed to provide secure VPN and remote access, making them a critical part of enterprise infrastructure.<\/p>\n

Alongside the hotfixes, SonicWall has published indicators of compromise (IOCs) and incident response guidance to help customers assess potentially affected appliances. CISA has also added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, reinforcing the need for organizations to patch affected systems without delay and investigate any signs of compromise.<\/p>\n

Incident at a Glance<\/h3>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Category<\/span><\/b>\u00a0<\/span><\/td>\nDetails<\/span><\/b>\u00a0<\/span><\/td>\n<\/tr>\n
Vendor<\/span><\/b>\u00a0<\/span><\/td>\nSonicWall<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Affected Product<\/span><\/b>\u00a0<\/span><\/td>\nSecure Mobile Access (SMA) 1000 appliances (SMA 6210, SMA 7210, SMA 8200v)<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Incident Type<\/span><\/b>\u00a0<\/span><\/td>\nActive zero-day vulnerability exploitation<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Vulnerabilities<\/span><\/b>\u00a0<\/span><\/td>\nCVE-2026-15409 (Critical SSRF) and CVE-2026-15410 (High-severity code injection)<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Severity<\/span><\/b>\u00a0<\/span><\/td>\nCritical (CVSS 10.0) and High<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Attack Surface<\/span><\/b>\u00a0<\/span><\/td>\nInternet-facing VPN and secure remote access infrastructure<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Exploitation Status<\/span><\/b>\u00a0<\/span><\/td>\nConfirmed active exploitation<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
CISA Status<\/span><\/b>\u00a0<\/span><\/td>\nAdded to the Known Exploited Vulnerabilities (KEV) Catalog<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Security Updates<\/span><\/b>\u00a0<\/span><\/td>\nHotfixes available for affected firmware versions<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Recommended Actions<\/span><\/b>\u00a0<\/span><\/td>\nApply the latest hotfixes, review indicators of\u00a0compromise (IOCs),\u00a0re-image\u00a0compromised appliances, rotate administrator and user credentials, and reset TOTP tokens<\/span>\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Who is affected?<\/h2>\n

The advisory affects organizations using SonicWall Secure Mobile Access (SMA) 1000 appliances for secure VPN and remote access.<\/p>\n\n\n\n\n
Affected appliances<\/span><\/b>\u00a0<\/span><\/td>\nFixed platform-hotfix versions<\/span><\/b>\u00a0<\/span><\/td>\n<\/tr>\n
SMA 6210, SMA 7210, and SMA 8200v<\/span>\u00a0<\/span><\/td>\n12.4.3-03453 or later, or 12.5.0-02835 or later, depending on the installed firmware branch\u00a0<\/span>\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Organizations running vulnerable 12.4.3 or 12.5.0 platform-hotfix releases should verify their firmware version and upgrade to the latest supported hotfix immediately. If an appliance may have been exposed before patching, review SonicWall’s published indicators of compromise (IOCs<\/a>) and follow the recommended recovery guidance.<\/p>\n

How the exploited vulnerabilities work<\/h2>\n

SonicWall has confirmed active exploitation of CVE-2026-15409 and CVE-2026-15410, two vulnerabilities affecting different components of the SMA1000 platform. While both flaws have been exploited in observed attacks, the company has not publicly disclosed the complete attack chain.<\/p>\n\n\n\n\n\n
Vulnerability<\/span><\/b>\u00a0<\/span><\/td>\nSeverity<\/span><\/b>\u00a0<\/span><\/td>\nAffected\u00a0Component<\/span><\/b>\u00a0<\/span><\/td>\nAuthentication Required<\/span><\/b>\u00a0<\/span><\/td>\nPotential Impact<\/span><\/b>\u00a0<\/span><\/td>\n<\/tr>\n
CVE-2026-15409<\/span><\/b>\u00a0<\/span><\/a><\/td>\nCritical (CVSS 10.0)<\/span>\u00a0<\/span><\/td>\nSMA1000 Appliance\u00a0Work Place\u00a0interface<\/span>\u00a0<\/span><\/td>\nNo<\/span>\u00a0<\/span><\/td>\nServer-Side Request Forgery (SSRF) that may force the appliance to make unintended requests<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
CVE-2026-15410<\/span><\/b>\u00a0<\/span><\/a><\/td>\nHigh<\/span>\u00a0<\/span><\/td>\nSMA1000 Appliance Management Console<\/span>\u00a0<\/span><\/td>\nAdministrator<\/span>\u00a0<\/span><\/td>\nPost-authentication code injection that may allow arbitrary operating system\u00a0command execution<\/span>\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

CVE-2026-15409: Critical SSRF vulnerability<\/span><\/span><\/h3>\n

This critical SSRF vulnerability may allow a remote, unauthenticated attacker to make the appliance send requests to unintended locations. With a CVSS score of 10.0, it is the most severe flaw addressed in the advisory.<\/p>\n

CVE-2026-15410: High-severity code injection vulnerability<\/h3>\n

This vulnerability affects the SMA1000 Appliance Management Console and may allow a remote authenticated administrator to execute arbitrary operating system commands under specific conditions.<\/p>\n

SonicWall has not publicly identified the threat actor or disclosed the number of affected organizations. At the time of publication, neither SonicWall’s advisory nor public reporting confirms credential theft, data exfiltration, ransomware deployment, or malware installation resulting from the observed exploitation.<\/p>\n

Indicators of Compromise<\/h2>\n

SonicWall has published several indicators of compromise (IOCs) to help administrators identify potentially affected SMA1000 appliances.<\/p>\n

Security teams should investigate:<\/p>\n