Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands

SonicWall warned of active exploitation of two zero-day vulnerabilities affecting Secure Mobile Access 1000 series appliances, one of which could allow arbitrary command execution as administrator, the company said. The flaws are tracked as CVE-2026-15409, a server-side request forgery vulnerability with a CVSS score of 10.0, and CVE-2026-15410, a post-authentication code injection vulnerability in the Appliance Management Console with a CVSS score of 7.2. SonicWall said it investigated multiple cases indicating active exploitation and urged customers to apply fixes immediately. Patches are available in versions 12.4.3-03453 and higher and 12.5.0-02835 and higher. The company also provided indicators of compromise, including specific log entries in extraweb_access.log and ctrl-service.log and unauthorized routes in a configuration file. If indicators are present, SonicWall advised re-imaging physical appliances or redeploying virtual appliances, changing passwords, and resetting time-based one-time password tokens. Adam Babis of SonicWall's product security incident response team was credited with discovering and reporting the flaws. SonicWall acknowledged contributions from Volexity's Sean Koessel and Steven Adair. The U.S. Cybersecurity and Infrastructure Security Agency added the two flaws to its Known Exploited Vulnerabilities catalog, requiring Federal Civilian Executive Branch agencies to apply fixes by July 17, 2026.