SonicWall alerts exploitation of two SMA 1000 zero-days

SonicWall has issued an urgent security advisory warning that attackers are actively exploiting two critical vulnerabilities in its Secure Mobile Access (SMA) 1000 Series appliances. The company confirmed on July 15, 2026, that these flaws are being used in real-world attacks, prompting immediate calls for customers to apply available patches.

The most severe vulnerability, tracked as CVE-2026-15409, is a server-side request forgery (SSRF) flaw in the SMA1000 Workplace interface. It carries the maximum CVSS severity score of 10.0 and can be exploited remotely without requiring any authentication. This could allow an attacker to force a vulnerable appliance to send requests to unintended internal or external locations, potentially accessing services not normally reachable from the internet. The second issue, CVE-2026-15410, is a post-authentication code injection vulnerability in the Appliance Management Console with a CVSS score of 7.2. An attacker with administrator-level access could exploit this to execute arbitrary operating system commands on the appliance.

The vulnerabilities impact SMA1000 models 6210, 7210, and 8200 running specific versions of platform hotfix releases...