SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now

SonicWall warns that threat actors have been exploiting two SMA1000 vulnerabilities, tracked as CVE-2026-15409 and CVE-2026-15410, in zero-day attacks and urges customers to install the newly released security updates.

CVE-2026-15409 is a critical (CVSS 10.0) server-side request forgery (SSRF) vulnerability in the SMA1000 Appliance Work Place interface that allows a remote, unauthenticated attacker to force an appliance to make requests to unintended locations.

CVE-2026-15410 is a high-severity (CVSS 7.2) post-authentication code injection flaw in the SMA1000 Appliance Management Console that could allow a remote authenticated administrator to execute arbitrary operating system commands.

While CVE-2026-15410 requires administrator privileges, SonicWall assigned the advisory an overall CVSS score of 10.0.

SonicWall says it investigated multiple incidents and confirmed that both vulnerabilities are being actively exploited.

While CVE-2026-15410 requires administrator privileges, SonicWall assigned the advisory an overall CVSS score of 10.0.

SonicWall says it investigated multiple incidents and confirmed that both vulnerabilities are being actively exploited.

SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now

SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now

Other newsrooms on this story

Related reading

SonicWall Issues Urgent SMA Patch Warning for Two Zero-Day Exploits

SonicWall SMA1000 flaws exploited as zero-days to push custom malware

Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands

SonicWall SMA1000: Angriffe auf teils kritische Zero-Day-Lücken

SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch

SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access

Other newsrooms on this story

Related reading

SonicWall Issues Urgent SMA Patch Warning for Two Zero-Day Exploits

SonicWall SMA1000 flaws exploited as zero-days to push custom malware

Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands

SonicWall SMA1000: Angriffe auf teils kritische Zero-Day-Lücken

SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch

SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access