CRITICAL: SonicWall SMA 1000 Zero-Days Under Active Attack, One Scoring a Perfect 10.0

If you have a SonicWall SMA 1000 sitting at the edge of your network, stop reading for a moment and go check its firmware. I will wait. SonicWall has confirmed that attackers are already inside appliances belonging to real organizations, and they are chaining two freshly disclosed zero-days into unauthenticated, administrator level command execution on the exact box you trust to broker remote access into everything behind it. This is the definition of drop everything and patch it now, and the numbers make the case better than any amount of hand wringing could.

The headline flaw is CVE-2026-15409, a server side request forgery vulnerability that carries a CVSS score of 10.0. Not 9.8, not a rounding error away from perfect, but an actual maximum severity rating, which the scoring system reserves for the rare bug that a remote attacker can reach with no authentication, no user interaction, and total impact on the confidentiality, integrity, and availability of the target. It lives in the Appliance Work Place interface, the public facing portal that legitimate users hit to log into the VPN, which means it is exposed to anyone who can route a packet to the appliance. An unauthenticated attacker can abuse it to make the appliance issue requests to locations it was never meant to talk to, and that primitive turns out to be the front door.

The second bug, CVE-2026-15410, looks tamer on paper at CVSS 7.2. It is a post authentication code injection flaw in the Appliance Management Console, the administrative back end, and on its own it requires an attacker to already hold administrator privileges before it lets them run arbitrary operating system commands. That caveat is exactly why it does not stay a 7.2 in practice. When you pair the SSRF with the code injection, the SSRF becomes the mechanism that satisfies the authentication requirement, and the whole chain collapses into unauthenticated remote code execution running as administrator. SonicWall rated the combined advisory a 10.0 for that reason, and it is the correct call. A moderate severity bug that only matters once you are already an admin becomes catastrophic the instant a separate flaw hands you that admin context for free.

None of this is theoretical. SonicWall stated plainly that it has "investigated multiple cases indicating the active exploitation of the vulnerabilities," which is corporate speak for we found real victims, plural, and we are telling you before the exploit details spread further. Adam Babis of SonicWall's product security team gets credit for the discovery, with researchers Sean Koessel and Steven Adair of Volexity named as contributors, and Volexity showing up on a report like this is worth noting because that firm tends to surface when a nation state or a well resourced intrusion set is doing the exploiting rather than opportunistic commodity crews. The U.S. Cybersecurity and Infrastructure Security Agency agreed with the urgency and added both CVEs to its Known Exploited Vulnerabilities catalog on July 14, giving federal civilian agencies a compressed deadline of July 17 to patch or pull the devices offline. When CISA gives you three days, that is not a suggestion.

The affected hardware is narrow enough to inventory quickly. The vulnerable models are the SMA 6210, the 7210, and the 8200v virtual appliance, all part of the SMA 1000 series that enterprises deploy for secure remote access. On the firmware side, the exposed platform hotfix releases include 12.4.3-03245, 12.4.3-03387, and 12.4.3-03434 on the 12.4 branch, along with 12.5.0-02283, 12.5.0-02624, and 12.5.0-02800 on the 12.5 branch. If your appliance is running any of those, it is vulnerable. The fixed builds are 12.4.3-03453 and later, or 12.5.0-02835 and later, and SonicWall was blunt that there are no workarounds. You cannot configure your way out of this one. The hotfix is the mitigation, so the only real decision is how fast you can schedule the maintenance window.

Detection is where this gets uncomfortable, because if you are only now hearing about the bugs, an attacker may have gotten there first. SonicWall published a useful set of indicators, and they are worth pulling into your log review immediately. In the extraweb_access.log, watch for requests to the paths /api/login or /api/logout returning an HTTP 200 status, since those endpoints should not be servicing traffic that way, and look for suspicious /wsproxy requests carrying odd host parameters and returning a 101 status that signals a protocol upgrade the attacker is using to tunnel. In the ctrl-service.log, hunt for hotfix rollbacks with path traversal style names, which is how the intruder manipulates the update mechanism. And in the appliance's own /var/lib/unit/conf.json, the presence of routes for /api/login or /api/logout is a red flag, because those routes have no business existing in a legitimate configuration. If you find any of that, treat the box as fully compromised rather than merely probed.

Assuming compromise changes the response entirely, and SonicWall's guidance here is the part most teams will be tempted to skip and should not. A patched but already breached appliance is still a breached appliance, because the attacker who reached administrator on a VPN concentrator has had the run of your remote access layer and quite possibly harvested credentials, session material, and configuration secrets on the way through. The vendor's recommendation is to re image physical appliances or redeploy the virtual instances from clean media rather than trusting an in place cleanup, then rotate every user and administrator password and reset the TOTP tokens that back your multifactor. That last step matters more than it looks, because an attacker with administrative control of the appliance is precisely positioned to have captured or cloned the seeds that make your second factor meaningful. Rotating passwords while leaving the same MFA secrets in place is the security equivalent of changing the locks and handing over a copy of the new key.

There is a broader lesson buried in this advisory that goes beyond one vendor's product line. Edge devices, the VPNs and firewalls and secure access gateways that sit at the perimeter and terminate untrusted traffic, have quietly become the single most productive category of initial access for serious intruders. They are internet exposed by design, they run complex software that rarely gets the same scrutiny as a workstation, they frequently cannot run an endpoint agent, and they hold the keys to the internal network. SonicWall's own SMA line has been targeted before, which is part of why Volexity and CISA moved so quickly here. When the same class of appliance keeps showing up in exploitation reports, the pattern is telling you where attackers have decided to invest, and it should tell you where your defensive attention belongs too.

For managed service providers, this is a conversation you should be having with clients before they read about it somewhere less friendly. A perfect 10.0 under active exploitation, sitting on a device that many small and midsize organizations installed years ago and quietly forgot about, is exactly the kind of event that justifies a recurring vulnerability management and edge asset monitoring service rather than the occasional heroic all nighter. The upsell writes itself, moving clients onto managed patching for perimeter appliances, layering in external attack surface monitoring so someone actually notices when a critical CVE lands on their exposed gear, and offering compromise assessment engagements for anyone who has been running vulnerable SMA firmware long enough to worry. The clients who lived through this patch cycle calmly will be the ones who already pay you to watch their edge, and that is the story worth telling every other prospect on your list.