SonicWall says two SMA1000 flaws are being used in live attacks

Key points

• SonicWall confirmed that two flaws in its SMA1000 remote-access appliances, CVE-2026-15409 and CVE-2026-15410, are being actively exploited.
• CVE-2026-15409 scores the maximum 10.0 on the industry severity scale and lets an unauthenticated attacker abuse the device remotely.
• Affected models are the SMA1000 6210 and 7210, plus the 8200v; fixes ship in hotfix builds 12.4.3-03453 and 12.5.0-02835.
• CISA added both bugs to its Known Exploited Vulnerabilities catalog; federal agencies must patch or disconnect by 17 July 2026.
• There's no workaround. Only the hotfix stops the attack.

SonicWall has confirmed criminals are actively breaking into its SMA1000 appliances, the boxes many organisations use to give remote workers a secure door into the corporate network. Both flaws were unknown to SonicWall until attacks were already under way, making them zero-days.

The first, CVE-2026-15409, sits in the appliance's web-based Work Place interface. It's a server-side request forgery flaw, a trick that makes the device fetch content on the attacker's behalf from places it shouldn't touch. No login required. SonicWall rates it a perfect 10.0 out of 10.

The second, CVE-2026-15410, lives in the Appliance Management Console. It lets an attacker already signed in as an administrator run their own commands on the underlying operating system, scoring 7.2 on its own. SonicWall assigned the overall advisory a 10.0, hinting the two bugs may be useful together. The company hasn't confirmed whether attackers are chaining them; BleepingComputer has asked SonicWall to clarify.

This pattern of a low-friction bug paired with a post-auth escalator is worth watching closely. It's the same architecture we saw in the Apple zero-day pair reported 3 July.

Who is affected?

Owners of SMA1000 models 6210, 7210 and 8200v running any of these hotfix builds: 12.4.3-03245, 12.4.3-03387, 12.4.3-03434, 12.5.0-02283, 12.5.0-02624 or 12.5.0-02800.

The flaws don't affect SSL-VPN on SonicWall firewalls or the smaller SMA 100 Series. Everyone else needs hotfix 12.4.3-03453 or 12.5.0-02835, or a later release. There's no config change or firewall rule that blunts the attack.

How do you know if you were hit?

SonicWall published indicators of compromise administrators can check on the device:

• Requests to /__api__/login or /__api__/logout in extraweb_access.log returning HTTP 200.
• Requests to /wsproxy in the same log carrying odd host parameters and a 101 status.
• Hotfix rollbacks in ctrl-service.log with path-traversal style filenames.
• Routes for either login or logout URI inside /var/lib/unit/conf.json, which a clean box should never contain.

If any appear, SonicWall's advice is blunt: wipe the appliance and rebuild it, or redeploy the virtual version from scratch. Reset every user and administrator password, then issue fresh TOTP tokens (the six-digit codes staff generate on their phones).

CISA has added both flaws to its Known Exploited Vulnerabilities catalog. Under Binding Operational Directive 26-04, federal civilian agencies must patch by 17 July 2026 or stop using the product. Private companies aren't bound by that deadline, but CISA doesn't add theoretical bugs to that list.

SonicWall's Product Security Incident Response Team says it investigated multiple confirmed intrusions. Neither the victims nor the attacker groups have been named.