Unauthenticated attackers exploit zero-day vulnerabilities in SonicWall SMA1000 appliances for code execution
Threat actors are actively exploiting two zero-day vulnerabilities in SonicWall SMA1000 appliances to perform server-side request forgery and arbitrary code execution. These flaws allow unauthenticated attackers to force the appliance to make unintended requests or, if authenticated as an administrator, execute operating system commands. Immediate patching is required as no workarounds exist.
Summary
SonicWall has confirmed that multiple incidents involving active exploitation of its SMA1000 appliances have been investigated by its Product Security Incident Response Team (PSIRT). The vulnerabilities involve a critical server-side request forgery (SSRF) flaw and a high-severity code injection vulnerability.
CISA has added both flaws to its Known Exploited Vulnerabilities (KEV) catalog, noting that federal agencies must secure affected systems by July 17, 2026. While the vulnerabilities affect specific SMA1000 models, SonicWall stated they do not impact SSL-VPN running on SonicWall firewalls or the broader SMA 100 Series product line.
Technical details
The first vulnerability, CVE-2026-15409, is a critical SSRF flaw (CVSS 10.0) residing in the SMA1000 Appliance Work Place interface. This allows a remote, unauthenticated attacker to force the appliance to make requests to unintended locations.
The second vulnerability, CVE-2026-15410, is a post-authentication code injection flaw (CVSS 7.2) located in the SMA1000 Appliance Management Console (AMC). Under specific conditions, a remote attacker with administrator privileges can execute arbitrary operating system commands. Despite the higher privilege requirement for this second flaw, SonicWall assigned the advisory an overall CVSS score of 10.0.
It is not yet confirmed whether attackers are chaining these two vulnerabilities together to move from unauthenticated SSRF to authenticated code execution.
Affected products and fixed versions
The flaws impact specific SMA1000 models running certain platform-hotfix releases.
| Model | Affected Platform-Hotfix Versions | Fixed Platform-Hotfix Versions |
|---|---|---|
| 6210, 7210, and 8200v | 12.4.3-03245, 12.4.3-03387, 12.4.3-03434, 12.5.0-02283, 12.5.0-02624, and 12.5.0-02800 | 12.4.3-03453 and 12.5.0-02835 (or later) |
Detection opportunities
Administrators can search for the following indicators of compromise (IOCs) to determine if an appliance has been breached:
- extraweb_access.log: Look for requests to
/__api__/loginor/__api__/logoutwith an HTTP 200 status. - extraweb_access.log: Look for requests to
/wsproxycontaining suspicious host parameters with an HTTP 101 status. - ctrl-service.log: Check for hotfix rollbacks that include path traversal names.
- /var/lib/unit/conf.json: Inspect this file for routes to
/__api__/loginor/__api__/logout. These URIs do not exist in legitimate configurations.
Defender guidance
Because there are no workarounds or mitigations available, the only defense is to upgrade to the latest hotfix release immediately.
If an analysis of your logs reveals any of the indicators mentioned above, follow these recovery steps:
- Re-image physical appliances or redeploy virtual appliances.
- Change all user and administrator passwords.
- Reset all TOTP tokens.
Sources
