Are You Confident in the Security of Your SonicWall SMA1000 Appliance? Cybercriminals Are Already Actively Exploiting Critical Zero-Day Vulnerabilities!

The most severe of the disclosed vulnerabilities is CVE-2026-15409, which has received the maximum CVSS score of 10.0.

This vulnerability is a Server-Side Request Forgery (SSRF) flaw affecting the SMA1000 Workplace interface. Its most alarming characteristic is that no authentication is required for exploitation. In other words, a remote attacker can send specially crafted requests to a vulnerable appliance without needing a valid username or password.

By exploiting this SSRF vulnerability, an attacker may:

SSRF vulnerabilities are particularly dangerous because they can provide attackers with covert access to an organization’s internal infrastructure.

The second vulnerability, tracked as CVE-2026-15410, has been assigned a CVSS score of 7.2.

This issue affects the SMA1000 Appliance Management Console and is classified as a Code Injection vulnerability.

Exploiting this flaw requires administrative privileges. If an attacker succeeds in compromising an administrator account or hijacking an active administrator session, they may execute arbitrary operating system commands and gain complete control over the appliance.

The vulnerabilities impact the following SonicWall SMA1000 models:

The issues have been identified in certain 12.4.3 and 12.5.0 platform hotfix releases.

SonicWall has also confirmed that these vulnerabilities do not affect:

SonicWall’s Product Security Incident Response Team (PSIRT) has investigated multiple real-world cyberattacks in which these vulnerabilities were successfully exploited.