Security AffairsPierluigi Paganini
SonicWall Warns of Active Exploitation of SMA 1000 Zero Days
SonicWall has issued a warning regarding the active exploitation of two zero-day vulnerabilities in its SMA 1000 appliances. The first vulnerability, CVE-2026-15409, is a critical Server-side Request Forgery (SSRF) flaw with a CVSS score of 10.0, allowing unauthenticated attackers to manipulate requests. The second, CVE-2026-15410, scored at 7.2, is a post-authentication code injection flaw enabling authenticated attackers to execute arbitrary operating system commands.
SonicWall recommends affected users upgrade to patched versions (12.4.3-03453 or 12.5.0-02835 and higher), perform forensic investigations, and monitor system logs for suspicious activity. Past vulnerabilities also affected the SMA 1000 management console, which had been previously exploited in the wild.
Story timeline CVE-2026-15409
Full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 15 Jul · 08:47 UTC | Security Affairs | SonicWall Warns of Active Exploitation of SMA 1000 Zero Days (this article) |
| Mon 3 Aug · 03:01 UTC | SecurityOnline | SonicWall SMA Exploit Chain Now Fuels INC Ransomware Attacks |
| Mon 3 Aug · 11:01 UTC | SecurityWeek | INC Ransomware exploits CVE-2026-15409, gains root on SonicWall |
| Tue 4 Aug · 14:31 UTC | Security Affairs | INC Ransomware abuses CVE-2026-15409 in SonicWall, calls victims |
| Fri 11 Sep · 07:13 UTC | SecurityOnline | SonicWall Flaw Exposed 160 Active Directory Domains to Attackers |
| Fri 11 Sep · 07:48 UTC | Security Affairs | SonicWall VPN Flaw Exposed Credentials Across 250 Organisations |
| Mon 12 Oct · 11:30 UTC | The Hacker News | Hackers Exploit Critical SonicWall SMA Flaw Within Days of Disclosure |
| Fri 23 Oct · 18:36 UTC | The Hacker News | AI Agents Power Ransomware Affiliates’ Attacks on Edge Devices |