SonicWall warns SMA1000 remote access gateways hit by zero-day attacks

SonicWall on July 14, 2026, released hotfixes for two vulnerabilities in its SMA1000 secure remote access appliances that attackers had exploited as zero-days. One of them, CVE-2026-15409, is a server-side request forgery flaw rated 10.0, the highest score on the CVSS scale.

SMA1000 gateways give employees and contractors remote access to internal applications, which makes them a high-value target. CISA added both flaws to its Known Exploited Vulnerabilities catalogue the same day and now lists both as known to be used in ransomware campaigns.

What happened

SonicWall's advisory SNWLID-2026-0008 describes CVE-2026-15409 as an SSRF flaw in the Work Place interface that a remote, unauthenticated attacker can use to make the appliance send requests to unintended locations. The second bug, CVE-2026-15410, is a code injection flaw in the Appliance Management Console rated 7.2. It requires administrator access but can let an attacker run operating system commands.

According to BleepingComputer, SonicWall's security team confirmed exploitation after investigating multiple incidents but did not say whether the two flaws were chained. Later reporting said the zero-days were used to deploy custom malware.

The Canadian Centre for Cyber Security published advisory AV26-699, noting SonicWall's statement that both flaws were being exploited.

SMA1000 appliances have been hit before: in December 2025, CISA listed another SMA1000 flaw, CVE-2025-40602, as exploited. Gateways from several vendors have become a favoured entry point for ransomware crews because they sit on the internet and authenticate outside users. CISA required U.S. federal agencies to secure affected systems by July 17 or stop using them.

Affected and fixed versions

Affected models are the SMA1000 6210, 7210 and 8200v running platform-hotfix releases 12.4.3-03245, 12.4.3-03387, 12.4.3-03434, 12.5.0-02283, 12.5.0-02624 and 12.5.0-02800. Fixes are in 12.4.3-03453 and 12.5.0-02835 or later. SSL VPN on SonicWall firewalls and the SMA 100 series are not affected. SonicWall says there are no workarounds.

What to do

• Install the fixed hotfix release now.
• Check extraweb_access.log for HTTP 200 requests to /__api__/login or /__api__/logout and HTTP 101 requests to /wsproxy with unusual host values.
• Look in /var/lib/unit/conf.json for routes to /__api__/login or /__api__/logout, which should not exist in a normal configuration.
• If you find signs of compromise, re-image physical appliances or redeploy virtual ones, change all user and admin passwords and reset TOTP tokens.