SonicWall SMA1000 Zero-Days: CVE-2026-15409 and CVE-2026-15410, What to Patch Today

If your organization runs a SonicWall SMA1000 appliance for remote access, this is the week to stop reading the changelog and go patch it. Two vulnerabilities, CVE-2026-15409 and CVE-2026-15410, are under active exploitation right now, and they’re not being used independently. SonicWall, Rapid7, and multiple other researchers have confirmed attackers are chaining them together for full compromise.

The chain, in order

CVE-2026-15409 is a server-side request forgery flaw in the SMA1000 Work Place interface, CVSS 10.0. It’s unauthenticated and remotely exploitable with no user interaction, which is what pushes it to the top of the CVSS scale even though SSRF bugs don’t always sound as dramatic as remote code execution. An attacker uses it to make the appliance itself issue requests to locations of their choosing, typically the opening move for reaching internal resources the appliance can see but an outside attacker normally can’t.

CVE-2026-15410 is a post-authentication code injection flaw in the SMA1000 Management Console, CVSS 7.2. On its own, “post-authentication” would normally lower the urgency, since it implies an attacker needs valid credentials first. That’s exactly where the chain matters: CVE-2026-15409 supplies the access that CVE-2026-15410 requires. Used together, an unauthenticated attacker reaches the Work Place interface, pivots through the SSRF to the Management Console, and then executes arbitrary operating system commands.

What attackers are actually doing once they’re in

This isn’t smash-and-grab activity. SonicWall’s own investigation and outside researchers describe a consistent post-compromise pattern: extracting stored credentials, pulling the appliance’s active session database, and grabbing TOTP multi-factor authentication seed configurations. Taken together, that’s a persistence playbook, not a one-time data theft. Stolen session tokens let an attacker skip re-authentication entirely, and stolen TOTP seeds mean MFA stops being a meaningful barrier on any account whose seed was exposed, since the attacker can generate valid codes going forward.

That’s the detail worth flagging to whoever owns identity and access at your organization: if you find evidence of exploitation, a password reset alone doesn’t close this. Any TOTP secrets that could have been read off the appliance need re-enrollment, not just rotation.

Affected hardware and the fix

Detail	Value
Affected products	SMA6210, SMA7210, SMA8200v
Vulnerable firmware	12.4.3-x builds through 03434; 12.5.0-x builds through 02800
Patched firmware	12.4.3-03453 or 12.5.0-02835
Where to get it	mysonicwall.com
Not affected	SMA100 series (separate codebase)

If you manage these appliances directly, the patch is the fix, but it’s not the whole remediation. Because credential and session theft are already confirmed in the wild, treat any unpatched appliance that’s been internet-facing during the exploitation window as potentially compromised until you’ve reviewed logs, not just patched and moved on.

What to do this week

1. Patch to 12.4.3-03453 or 12.5.0-02835 now, before anything else on your security backlog this week.
2. Review Work Place interface and Management Console logs for requests from unexpected sources predating the patch.
3. Rotate credentials and force MFA re-enrollment for any accounts with access through a potentially compromised appliance, don’t just reset passwords.
4. Note the July 17, 2026 deadline. That’s when CISA’s Binding Operational Directive 26-04 requires U.S. federal agencies to remediate or disconnect. It’s not a federal-only concern given the confirmed exploitation, it’s the honest floor for anyone running this hardware.

If vulnerability triage like this keeps landing as an unplanned fire drill instead of a routine part of your patch cycle, that’s usually a sign the underlying infrastructure and access review is overdue, not that this particular CVE was unusually bad luck. This one just happened to be chained, unauthenticated, and already in active use, which is a combination worth treating as the norm to plan for rather than the exception.