SonicWall SMA 1000 Zero-Days Actively Exploited in Attacks

Originally published on CyberNetSec.

Executive Summary

SonicWall has issued an urgent warning for customers to immediately patch two zero-day vulnerabilities affecting its Secure Mobile Access (SMA) 1000 series appliances. The vulnerabilities, CVE-2026-15409 and CVE-2026-15410, are being actively exploited in the wild by threat actors. The attack involves chaining the two flaws to achieve unauthenticated remote code execution (RCE) on vulnerable internet-facing devices. According to security firm Rapid7, which discovered the in-the-wild attacks, exploitation began as early as June 22, 2026. The compromise of these critical network security appliances can serve as an initial access point for broader network intrusion, credential theft, and potential ransomware deployment. Both vulnerabilities have been added to the CISA Known Exploited Vulnerabilities (KEV) catalog.

---

Vulnerability Details

The attack relies on a two-stage exploit chain:

1. CVE-2026-15409: Server-Side Request Forgery (SSRF)

   • CVSS Score: 10.0 (Critical)
   • This vulnerability allows an unauthenticated, remote attacker to send crafted requests from the vulnerable appliance to arbitrary internal or external services. In the observed attacks, threat actors use this SSRF to access an internal service on the appliance that is not normally exposed to the internet. This sets the stage for the second vulnerability.

2. CVE-2026-15410: Code Injection

   • CVSS Score: 7.2 (High)
   • This vulnerability allows an authenticated attacker to inject and execute arbitrary OS commands with root privileges. By leveraging the SSRF flaw to reach the necessary internal endpoint, an attacker can trigger this code injection vulnerability without prior authentication, effectively combining the two into an unauthenticated RCE chain.

Affected Systems

The vulnerabilities affect the following SonicWall products running specific firmware versions:

• Product: SonicWall SMA 1000 Series (Appliances 6210, 7210, and 8200v)
• Affected Versions: 12.4.3 and 12.5.0

Organizations using these appliances for remote access are at high risk, as these devices are by nature internet-exposed.

Exploitation Status

Active exploitation has been confirmed in the wild by Rapid7's MDR team since at least June 22, 2026, nearly three weeks before patches were released on July 14, 2026. Attackers are using the exploit chain to gain a foothold on the appliances, from which they can extract credentials, active user session data, and MFA configurations. This information is highly valuable for facilitating lateral movement and deploying ransomware within the victim's network.

CISA has added both CVEs to its KEV catalog and has set a patching deadline of July 17, 2026, for Federal Civilian Executive Branch agencies, underscoring the extreme urgency.

---

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns to identify potential compromise:

Type	Value	Description	Context
url_pattern	/cgi-bin/viewcert	The observed SSRF attack vector involves requests to this endpoint. Monitor for unusual patterns or requests from unexpected IP addresses.	Web Server Logs, WAF Logs
file_path	/tmp/	Attackers may write temporary scripts or output files to this directory after successful code injection.	File Integrity Monitoring, Live Response
process_name	sslvpn_webapp.py	This is a core process on the appliance. Monitor for this process spawning unexpected child processes like sh, bash, or wget.	EDR, Process Auditing on Appliance
network_traffic_pattern	Outbound connections from SMA appliance to unknown IPs	Compromised appliances may be used to establish reverse shells or exfiltrate data. Monitor for anomalous outbound traffic.	Firewall Logs, Netflow

Detection Methods

1. Log Analysis: Scrutinize web server and application logs on SMA 1000 appliances for any requests to the /cgi-bin/viewcert endpoint, especially those that appear anomalous or originate from untrusted sources. Look for evidence of command injection in request parameters if possible.
2. Network Monitoring: Monitor network traffic originating from the SMA appliance's management interface. Look for outbound connections to suspicious IP addresses or ports, which could indicate an active C2 channel. This aligns with D3FEND Network Traffic Analysis.
3. Endpoint/Appliance Monitoring: If possible, monitor running processes on the SMA appliance. Look for the sslvpn_webapp.py process spawning shell commands (sh, bash, curl, wget) or other unexpected binaries. This aligns with D3FEND Process Analysis.

Remediation Steps

1. Patch Immediately: The primary remediation is to apply the hotfix patches released by SonicWall as soon as possible. Given the active exploitation, this should be considered an emergency change.
2. Restrict Access: As a compensating control, limit access to the SMA appliance's management interface to a trusted set of IP addresses. This can reduce the attack surface but will not protect against attacks from an already compromised internal source.
3. Hunt for Compromise: After patching, review logs and system state for the indicators of compromise provided by SonicWall and security researchers. If compromise is suspected, assume credentials and session data stored on the appliance have been stolen. Initiate incident response procedures, including rotating all credentials associated with the SMA appliance and terminating active sessions.