![\"SonicWall\"](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2026\/07\/Sonicwall.jpg\")
<\/p>\n<\/p>\n
SonicWall warns that threat actors have been exploiting two SMA1000 vulnerabilities, tracked as\u00a0CVE-2026-15409 and CVE-2026-15410, in zero-day attacks and urges customers to install the newly released security updates.<\/p>\n
CVE-2026-15409 is a critical (CVSS 10.0) server-side request forgery (SSRF) vulnerability in the\u00a0SMA1000 Appliance Work Place interface that allows a remote, unauthenticated attacker to force an appliance to make requests to unintended locations.<\/p>\n
CVE-2026-15410 is a high-severity (CVSS 7.2) post-authentication code injection flaw in the SMA1000 Appliance Management Console that could allow a remote authenticated administrator to execute arbitrary operating system commands.<\/p>\n
While CVE-2026-15410 requires administrator privileges, SonicWall assigned the advisory an overall CVSS score of 10.0.<\/p>\n SonicWall says it investigated multiple incidents and confirmed that both vulnerabilities are being actively exploited.<\/p>\n “SonicWall PSIRT has investigated multiple cases indicating the active exploitation of the vulnerabilities described in this advisory,” SonicWall warned<\/a>.<\/p>\n “Customers are strongly urged to upgrade to the hotfix release as soon as possible to remediate these vulnerabilities”<\/p>\n However, the company has not\u00a0disclosed whether attackers are chaining them together.\u00a0BleepingComputer has contacted SonicWall to clarify the attacks and will update this story if we receive a response.<\/p>\n The vulnerabilities affect SMA1000 models 6210, 7210, and 8200v running platform-hotfix releases 12.4.3-03245, 12.4.3-03387, 12.4.3-03434, 12.5.0-02283, 12.5.0-02624, and 12.5.0-02800.\u00a0 Fixes are available in platform-hotfix versions 12.4.3-03453 and 12.5.0-02835, and later releases.\u00a0<\/p>\n SonicWall says the vulnerabilities do not impact SSL-VPN running on SonicWall firewalls or the SMA 100 Series product line.<\/p>\n The company also shared indicators of compromise (IOCs) that administrators can use to determine whether an appliance has been compromised:<\/p>\n if in extraweb_access.log are mentioned requests to \/__api__\/login or \/__api__\/logout with HTTP 200 status
SonicWall strongly recommends upgrading to the latest hotfix release and performing\u00a0an\u00a0analysis to determine if any of the above IOCs are present.<\/p>\n If a device is found to be compromised, the company advises administrators to re-image physical appliances or redeploy virtual appliances, change all user and administrator passwords, and reset TOTP tokens.<\/p>\n SonicWall also notes that there are no workarounds or mitigations for these flaws other than installing the hotfixes.<\/p>\n The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming they are being actively exploited in attacks.<\/p>\n Federal agencies have until July 17, 2026, to secure affected systems under Binding Operational Directive (BOD) 26-04 or discontinue use of the product if mitigations cannot be applied.<\/p>\n![\"image\"](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2026\/07\/ti-97.jpg\")
<\/a><\/p>\n
\n\tif in extraweb_access.log are mentioned requests to \/wsproxy with suspicious host parameters with 101 HTTP status
\n\tif in ctrl-service.log are mentioned hotfix rollbacks with path traversal names
\n\tif \/var\/lib\/unit\/conf.json contains routes for \/__api__\/login or \/__api__\/logout (these URIs do not exist in legitimate configuration)
<\/p>\n
![\"article](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2026\/06\/bas-report.jpg\")