# SonicWall SMA1000 Zero-Day Vulnerabilities (CVE-2026-15409, CVE-2026-15410) Actively Exploited in Tandem

> SonicWall PSIRT confirmed active, in-the-wild exploitation of two SMA1000 Series zero-days: an unauthenticated SSRF in the Workplace interface (CVE-2026-15409, CVSS 10.0) and a post-authentication OS command injection in the Appliance Management Console (CVE-2026-15410, CVSS 7.2). Attackers have been observed chaining the two flaws together against SMA6210, SMA7210, and SMA8200v appliances running platform-hotfix 12.4.3 or 12.5.0. Volexity assisted SonicWall's investigation and IOC development.

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-07-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1357
- **ID:** TL-2026-1357
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-15409, CVE-2026-15410

## Description

On 2026-07-14, SonicWall PSIRT published advisory SNWLID-2026-0008 disclosing two zero-day vulnerabilities in the SMA1000 Series Secure Mobile Access appliance line that are being actively exploited against customer environments. CVE-2026-15409 is a Server-Side Request Forgery (SSRF, CWE-918) vulnerability in the SMA1000 Appliance Work Place interface with CVSS 3.1 base score 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) — the changed-scope (S:C) vector reflects the SSRF's ability to pivot the trust boundary from the appliance into internal or otherwise unreachable network segments, requiring no authentication and no user interaction. CVE-2026-15410 is a post-authentication Code Injection vulnerability (CWE-94, 'Improper Control of Generation of Code') in the SMA1000 Appliance Management Console (AMC), CVSS 3.1 base score 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), allowing an authenticated administrator-level attacker to execute arbitrary operating system commands on the underlying Linux platform. SonicWall assigned the advisory an overall severity of CVSS 10.0 reflecting the combined risk when the two bugs are chained.

SonicWall states it investigated multiple confirmed intrusion cases and, while it has not formally confirmed a single deterministic exploit chain, independent reporting (BleepingComputer, Help Net Security, The Hacker News) indicates the vulnerabilities are 'being exploited in tandem' in observed attacks: the unauthenticated SSRF is used for initial access/reconnaissance and to reach internal-only services, after which the authenticated code-injection flaw in the AMC is leveraged to obtain OS-level command execution on the appliance, granting the attacker durable control of the SMA1000 as an edge device and pivot point into the protected network.

Affected hardware/virtual models are SMA6210, SMA7210, and SMA8200v running vulnerable platform-hotfix builds: 12.4.3-03245, 12.4.3-03387, 12.4.3-03434, 12.5.0-02283, 12.5.0-02624, and 12.5.0-02800. SonicWall's SSL-VPN service on its firewalls and the separate SMA 100 Series product line are explicitly NOT affected. Patches are available as platform-hotfix 12.4.3-03453 (or later) and 12.5.0-02835 (or later) via the MySonicWall customer portal. SonicWall has published forensic IOC guidance (log entries in extraweb_access.log, ctrl-service.log, and /var/lib/unit/conf.json) and states that patching alone is not sufficient — administrators must conduct forensic review for prior compromise and, if found, re-image physical appliances or redeploy virtual instances from a known-clean image, then reset all local user and administrator passwords and TOTP/MFA tokens, since credentials and secrets on a compromised appliance cannot be trusted.

CISA added both CVEs to the Known Exploited Vulnerabilities (KEV) catalog on 2026-07-14, with a Binding Operational Directive 26-04 remediation deadline of 2026-07-17 for Federal Civilian Executive Branch agencies — an unusually tight 3-day window reflecting the severity and confirmed in-the-wild exploitation. No public threat-actor attribution has been released as of publication; SonicWall and Volexity's investigation remains ongoing.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1588.005 Exploits
- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1203 Exploitation for Client Execution
- T1505.003 Web Shell
- T1078 Valid Accounts
- T1068 Exploitation for Privilege Escalation
- T1685.006 Clear Linux or Mac System Logs
- T1211 Exploitation for Stealth
- T1552.001 Credentials In Files
- T1606 Forge Web Credentials
- T1046 Network Service Discovery
- T1082 System Information Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1090.001 Internal Proxy
- T1498 Network Denial of Service

## Sources

- [SonicWall Firewall 0-Day Vulnerabilities Exploited](https://cybersecuritynews.com/sonicwall-firewall-0-day-vulnerabilities-exploited/)
- [SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410)](https://www.helpnetsecurity.com/2026/07/14/sonicwall-sma-attacks-via-cve-2026-15409-cve-2026-15410/)
- [SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now](https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-sma1000-flaws-exploited-in-zero-day-attacks-patch-now/)
- [Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands](https://thehackernews.com/2026/07/two-sonicwall-sma-1000-zero-days.html)
- [SonicWall Security Advisory SNWLID-2026-0008](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008)
- [NVD - CVE-2026-15409](https://nvd.nist.gov/vuln/detail/CVE-2026-15409)
- [NVD - CVE-2026-15410](https://nvd.nist.gov/vuln/detail/CVE-2026-15410)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [CVE-2026-15409 - Vulnerability-Lookup](https://vulnerability.circl.lu/vuln/CVE-2026-15409)
- [CVE-2026-15410 - Vulnerability-Lookup](https://vulnerability.circl.lu/vuln/CVE-2026-15410)
- [CISA Adds Four Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-adds-four-known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1357