SonicWall SMA1000 Zero-Days: Patch Two CVSS 10.0 Flaws by July 17

For cybersecurity teams managing enterprise remote access, the latest SonicWall advisory demands immediate triage. Two zero-day vulnerabilities—including an unauthenticated SSRF with a CVSS 10.0 score—are under active attack, potentially chaining with an authenticated OS command injection flaw. CISA's rapid addition to the Known Exploited Vulnerabilities list signals federal-level urgency; every SME and SOC must validate exposure and patch within the 72-hour window.

SonicWall has disclosed two zero-day vulnerabilities in its SMA1000 secure remote access appliance line—CVE-2026-15409 (critical SSRF, CVSS 10.0) and CVE-2026-15410 (high-severity post-authentication code injection, CVSS 7.2)—which are being actively exploited in the wild. The vendor's Product Security Incident Response Team (PSIRT) confirmed multiple incident investigations revealing exploitation, though the threat actor’s identity and motives remain unknown. The advisory, released on July 14, 2026, carries an overall CVSS score of 10.0 due to the combined risk, and urges immediate upgrade to hotfix releases 12.4.3-03453 or 12.5.0-02835 for all affected models: SMA1000 6210, 7210, and 8200v.

“

The advisory, released on July 14, 2026, carries an overall CVSS score of 10.0 due to the combined risk, and urges immediate upgrade to hotfix releases 12.4.3-03453 or 12.5.0-02835 for all affected models: SMA1000 6210, 7210, and 8200v.

CVE-2026-15409 exists in the Appliance Work Place interface and allows a remote, unauthenticated attacker to trigger server-side request forgery (SSRF), causing the appliance to make unintended requests. This can be leveraged to access internal services, pivot into corporate networks, or bypass security controls. CVE-2026-15410 resides in the Appliance Management Console (AMC) and enables an authenticated administrator to inject and execute arbitrary OS commands. While the CVSS for this flaw is 7.2 due to the required privileges, the combination with the SSRF vulnerability could permit an attacker to chain exploits—first gaining a foothold via SSRF, then escalating privileges or achieving code execution. SonicWall has not explicitly confirmed chaining, but the context and available indicators of compromise (IOCs) suggest such a scenario is plausible.

The rapid response from CISA underscores the severity. On the same day as the advisory, CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog, setting a tight remediation deadline of July 17, 2026, for U.S. federal agencies. This marks the 17th SonicWall-related entry in the KEV catalog, reflecting a troubling pattern of threat actors—from ransomware groups to nation-state advanced persistent threats (APTs)—repeatedly targeting SonicWall VPN and secure access products. Previous campaigns, such as the exploitation of SMA 100 series and SSL-VPN vulnerabilities, have led to widespread compromises, including ransomware deployments and data exfiltration.

The affected SMA1000 series is designed for large enterprises, supporting up to 10,000 concurrent connections, making these appliances high-value targets. An attacker who gains control could intercept remote sessions, compromise internal resources, or use the appliance as a launchpad for lateral movement. SonicWall has not provided workarounds, emphasizing that patching is the only effective mitigation. Administrators must also review logs for IOCs provided in the advisory and, if compromise is detected, re-image physical appliances or redeploy virtual instances to ensure integrity.