SonicWall SMA1000 remote-access appliances hit by exploited zero-day flaws

SonicWall is warning that two flaws in its SMA1000 remote-access appliances are being actively exploited as zero-days, and has released hotfixes. CVE-2026-15409 is an unauthenticated server-side request forgery bug in the appliance's WorkPlace interface that lets an attacker make the device send requests to internal systems, turning an edge gateway into a pivot point. CVE-2026-15410 is a code-injection flaw in the management console that lets an administrator run operating-system commands, and SonicWall rates the overall advisory a top CVSS score of 10.0. Both were added to CISA's exploited-vulnerabilities catalog, with a federal deadline of July 17. Because exploitation is confirmed, any unpatched appliance should be treated as potentially compromised.

Check

Identify all SonicWall SMA1000 appliances, including standby and disaster-recovery nodes, apply the hotfix immediately, and review authentication logs, new accounts, outbound connections, and configuration changes for signs of intrusion.

Affected

Organizations running SonicWall SMA1000 remote-access appliances (CVE-2026-15409, CVE-2026-15410); attackers are actively exploiting the flaws, and the request-forgery and code-injection bugs could be chained to reach and run commands on internal systems.

Fix

Apply SonicWall's hotfix now, restrict management interfaces to trusted networks until patched, and because exploitation is confirmed, run a compromise assessment and assume unpatched appliances may already be backdoored.