SonicWall has issued an urgent security advisory regarding two serious vulnerabilities affecting its SMA1000 Series (Secure Mobile Access) remote access appliances. Most concerning is the fact that these vulnerabilities have already been confirmed to be actively exploited by cybercriminals in real-world attacks.

According to security experts, successful exploitation of these vulnerabilities could allow attackers to gain unauthorized access to an organization’s internal network, take control of affected systems, and compromise sensitive data. As a result, SonicWall has classified these issues as critical security risks that require immediate remediation.

The Most Critical Vulnerability – CVE-2026-15409

The most severe of the disclosed vulnerabilities is CVE-2026-15409, which has received the maximum CVSS score of 10.0.

This vulnerability is a Server-Side Request Forgery (SSRF) flaw affecting the SMA1000 Workplace interface. Its most alarming characteristic is that no authentication is required for exploitation. In other words, a remote attacker can send specially crafted requests to a vulnerable appliance without needing a valid username or password.

By exploiting this SSRF vulnerability, an attacker may:

• Discover internal services that are not directly accessible from the Internet;
• Scan internal network resources;
• Establish a foothold for launching attacks against other systems;
• Build additional exploitation chains leading to further compromise.

SSRF vulnerabilities are particularly dangerous because they can provide attackers with covert access to an organization’s internal infrastructure.

The Second Vulnerability – CVE-2026-15410

The second vulnerability, tracked as CVE-2026-15410, has been assigned a CVSS score of 7.2.

This issue affects the SMA1000 Appliance Management Console and is classified as a Code Injection vulnerability.

Exploiting this flaw requires administrative privileges. If an attacker succeeds in compromising an administrator account or hijacking an active administrator session, they may execute arbitrary operating system commands and gain complete control over the appliance.

Which Devices Are Affected?

The vulnerabilities impact the following SonicWall SMA1000 models:

• SMA 6210;
• SMA 7210;
• SMA 8200.

The issues have been identified in certain 12.4.3 and 12.5.0 platform hotfix releases.

SonicWall has also confirmed that these vulnerabilities do not affect:

• Firewall SSL-VPN services;
• SMA 100 Series appliances.

Active Exploitation Confirmed

SonicWall’s Product Security Incident Response Team (PSIRT) has investigated multiple real-world cyberattacks in which these vulnerabilities were successfully exploited.

At this time, the company has not publicly disclosed technical details regarding the threat actors or exploitation techniques involved. However, SonicWall has officially confirmed that the vulnerabilities are being actively exploited and strongly urges all customers to install the available security updates as soon as possible.

Indicators of Compromise (IoCs)

Administrators are advised to carefully review system logs for signs of compromise.

The following indicators may suggest that an appliance has been compromised:

• Suspicious requests to /api/login or /api/logout returning HTTP 200 responses in extraweb_access.log;
• Suspicious requests to /wsproxy containing unusual host parameters and returning HTTP 101 responses;
• Hotfix rollback entries resembling path traversal activity in ctrl-service.log;
• The presence of /api/login or /api/logout routes within /var/lib/unit/conf.json. Under normal configurations, these routes should not exist.

Recommended Mitigation Measures

SonicWall has stated that no workaround is available for these vulnerabilities. Therefore, installing the latest security updates is the only reliable mitigation.

Organizations are strongly encouraged to take the following actions:

• Upgrade SMA1000 appliances to version 12.4.3-0345 or a later hotfix release;
• Upgrade appliances running the 12.5.0 branch to version 12.5.0-0283 or a later hotfix release;
• Perform a comprehensive review of all system logs;
• If indicators of compromise are detected, re-image physical appliances or redeploy virtual appliances;
• Reset passwords for all user and administrator accounts;
• Reissue all Time-based One-Time Password (TOTP) tokens;
• Enforce Multi-Factor Authentication (MFA) for all administrator accounts;
• Restrict access to management interfaces so they are only accessible from trusted networks or through VPN connections;
• Continuously monitor appliances and analyze security logs using SIEM platforms.

Remote access infrastructure has become one of the most critical components of modern enterprise networks. Consequently, zero-day vulnerabilities affecting these appliances pose a significant threat to organizational cybersecurity.

In particular, vulnerabilities such as CVE-2026-15409, which can be exploited without authentication and carry the maximum CVSS score of 10.0, represent highly valuable targets for cybercriminals.

To minimize the risk of compromise, organizations should deploy security updates without delay, thoroughly investigate any indicators of compromise, and implement additional security measures such as Multi-Factor Authentication (MFA), continuous monitoring, and robust access controls.

In modern cybersecurity practice, one of the most effective defenses is maintaining systems with the latest security updates before vulnerabilities become widely exploited, while continuously monitoring the security posture of critical infrastructure.