Critical SonicWall SMA 1000 Vulnerabilities Exploited in the Wild

SonicWall has confirmed active exploitation of multiple vulnerabilities in Secure Mobile Access (SMA) 1000 series devices — enterprise VPN gateways that provide remote access to organizational resources. The affected models are 6210, 7210 and 8200v. One of the vulnerabilities has a maximum CVSS score of 10.0 and allows an unauthenticated attacker to gain access to critical device functionality. Organizations using these products must immediately install updates and check for signs of compromise.

Confirmed vulnerabilities

According to the official SonicWall security advisory published on July 14, 2026, active exploitation of two vulnerabilities has been confirmed:

• CVE-2026-15409 (CVSS 10.0) — an SSRF (Server-Side Request Forgery) vulnerability in the Appliance Work Place interface that does not require authentication. It allows a remote attacker to gain unauthorized access to sensitive device functionality.
• CVE-2026-15410 (CVSS 7.2) — an operating system command injection vulnerability in the Appliance Management Console (AMC), which requires administrator-level authentication. It allows arbitrary OS commands to be executed.

SonicWall states that it has investigated multiple instances of active exploitation of these vulnerabilities. The combination of a pre-authentication SSRF with a post-authentication command injection creates an attack chain that can potentially lead to full remote code execution on the target device.

Important clarification: some sources also mention CVE-2026-83548 and CVE-2026-83549 as a separate pair of SMA 1000 vulnerabilities. However, at the time of writing, the contents of the corresponding advisory (SNWLID-2026-0016) could not be independently verified, and the descriptions and affected versions largely overlap with the confirmed advisory for CVE-2026-15409/CVE-2026-15410. Confusion over identifiers in primary sources cannot be ruled out.

Affected products and versions

The vulnerabilities affect SonicWall SMA 1000 devices, models 6210, 7210 and 8200v, running the following firmware versions:

• 12.4.3-03245
• 12.4.3-03387
• 12.4.3-03434
• 12.5.0-02283
• 12.5.0-02624
• 12.5.0-02800

Patched versions: 12.4.3-03453 and 12.5.0-02835 (platform-hotfix). SonicWall explicitly emphasizes that these vulnerabilities do not affect SSL-VPN on SonicWall firewalls or the SMA 100 Series product line.

Indicators of compromise

SonicWall has provided specific indicators that can help determine whether a device has been compromised. According to the vendor notice, you should check for:

• HTTP requests with a 200 response code to the paths /__api__/login or /__api__/logout in the extraweb_access.log file
• Suspicious host parameters in /wsproxy requests that return HTTP 101 in the same logs
• Entries related to hotfix rollback with signs of path traversal in the ctrl-service.log file
• Unauthorized /__api__/login or /__api__/logout routes in the configuration file /var/lib/unit/conf.json

Impact assessment

SMA 1000 devices are primarily used by large and mid-sized organizations to provide secure remote employee access to corporate resources. Compromising such a device gives an attacker a foothold on the network perimeter with the ability to intercept credentials, pivot deeper into the infrastructure, and access internal systems.

The maximum CVSS score of 10.0 for the pre-authentication vulnerability means that the attack requires neither credentials nor user interaction to begin. Confirmed active exploitation makes this threat a top priority for immediate response.

Protection recommendations

SonicWall recommends the following sequence of actions:

1. Immediately update the firmware to the patched versions 12.4.3-03453 or 12.5.0-02835 (platform-hotfix).
2. Check the device for the above indicators of compromise — analyze the extraweb_access.log and ctrl-service.log files and the /var/lib/unit/conf.json configuration.
3. If signs of compromise are found:
   • Perform a full re-image or redeployment of the device
   • Change all user and administrator passwords
   • Reset TOTP (Time-based One-Time Password) tokens

Internal vulnerability discovery is credited to SonicWall researcher Adam Babis, and specialists from Volexity — Sean Koessel and Steven Adair — contributed to advancing the investigation.

Given the confirmed active exploitation and the critical CVSS 10.0 rating, SMA 1000 administrators should treat installing updates as a task of the highest priority — within hours rather than days. Even after updating, a full check for indicators of compromise is necessary: if the device was compromised before the patch was applied, simply updating the firmware is not enough to remediate the impact.