CVE-2026-15409 and CVE-2026-15410: SonicWall SMA 1000 Zero-Days

Two chained zero-days in SonicWall SMA 1000 series remote access appliances let a remote attacker go from zero access to code execution on the device. The chain combines a pre-authentication SSRF scoring CVSS 10 (CVE-2026-15409) with a post-authentication command injection (CVE-2026-15410). It matters right now because these flaws were exploited in the wild for weeks before a patch existed, and CISA has already added them to its Known Exploited Vulnerabilities catalog.

In this article we break down how each vulnerability works, why chaining them is so dangerous, which SonicWall SMA 1000 models and versions are affected, who discovered and exploited the flaws, and what an organization with one of these appliances exposed to the internet should do. We also explain why SSL-VPN concentrators are a prime initial-access target and how this incident fits into a defensive strategy built on continuously reducing exposure.

Key takeaways

• CVE-2026-15409 is a pre-authentication SSRF (CVSS 10) in the "Work Place" interface of the SMA1000 appliance.
• CVE-2026-15410 is a post-authentication OS command injection (CVSS 7.2) in the Appliance Management Console (AMC).
• Chained together they allow code execution on the appliance, a direct pivot into the internal network.
• It affects the SMA 1000 series (models 6210, 7210 and 8200v), which is distinct from the SMA 100 series.
• Real-world exploitation started around June 22, 2026, weeks before the July 14 disclosure.
• Hotfixes are available (v12.4.3-03453 and 12.5.0-02835) through SonicWall Support, and CISA added them to the KEV catalog.

What CVE-2026-15409 and CVE-2026-15410 are

These are two independent vulnerabilities that, combined, form a complete attack chain against SonicWall Secure Mobile Access (SMA) 1000 series remote access concentrators. On its own, each has a bounded impact, but chained together the outcome is code execution on the appliance itself, with everything that implies for a piece of network gear sitting on the perimeter.

If the concept of a CVE identifier is new to you, it helps to review what a CVE is and how the CVSS scoring system helps prioritize. Here the scores (10 and 7.2) capture the asymmetry of the chain nicely: the first link is trivial to reach, and the second delivers the execution impact.

CVE-2026-15409: pre-authentication SSRF (CVSS 10)

CVE-2026-15409 is a Server-Side Request Forgery (SSRF) in the "Work Place" interface of the SMA1000 appliance. An SSRF lets an attacker make the server issue network requests to destinations the attacker chooses, rather than those the application intends. Requiring no authentication is a key factor in its severity, though the CVSS 10 score results from the full vector (remote network access, no privileges or user interaction, and high impact): an unauthenticated remote attacker can force the appliance to make requests to unintended destinations.

An SSRF on a perimeter device is severe on two counts. First, the appliance typically has network visibility into internal services the attacker cannot reach from outside. Second, it acts as a springboard to reach the device's own internal management interfaces. If you want a standalone explanation of this vulnerability class, we have a dedicated guide on what SSRF is with impact examples.

CVE-2026-15410: post-authentication command injection (CVSS 7.2)

CVE-2026-15410 is a post-authentication OS command injection in the Appliance Management Console (AMC). Command injection happens when user-controlled input reaches a system call without proper sanitization, so the attacker can append arbitrary commands that run with the process's privileges. Here the requirement is that the attacker be authenticated to the AMC, which on paper limits its reach.

The value of the chain is in combining both flaws. According to SonicWall and the teams that analyzed it, the two CVEs were exploited together to reach code execution on the appliance. The exact mechanism by which the pre-authentication access enables the post-authentication step has not been published in detail, and it should not be assumed that an internal or trusted origin by itself satisfies the second flaw's authentication requirement.

How they chain to execute code

The chain turns two flaws of very different severity into a full compromise. The pre-authentication SSRF (CVE-2026-15409) lets the attacker reach, from the appliance itself, internal destinations that would otherwise be unreachable from the internet, including the AMC surface. On that basis the post-authentication command injection (CVE-2026-15410) comes into play, and the two CVEs were exploited chained together to execute code on the device.

The net result is code execution on the appliance. This pattern (an access flaw chained with an impact flaw) is common in network device exploitation and is exactly what we study when we look at what an exploit is and how reliable exploit chains are built. A single link is rarely enough; it is the combination that breaks the product's security model.

Why pre-auth changes the risk level

The difference between a flaw that requires authentication and one that does not is enormous in terms of exposure. A pre-auth SSRF is mass-scannable: an attacker can sweep entire ranges of the internet for vulnerable appliances with no credentials, no friction and at scale. Device-discovery tooling makes that location trivial; it is worth understanding what Shodan is to grasp just how visible a VPN concentrator is from outside.

When the first link of a chain is pre-auth and trivial to reach, the window between exploit availability and mass exploitation shrinks dramatically. That is why a CVSS 10 on a perimeter device must be treated as an operational emergency, not as one more item in the monthly patch cycle.

Affected models and versions

The chain affects the SonicWall SMA 1000 series (Secure Mobile Access). Specifically, the identified models are:

• SMA 6210
• SMA 7210
• SMA 8200v

One nuance is critical and a frequent source of confusion: this is the SMA 1000 series, which is distinct from the SMA 100 series. They are different product lines, and mixing them up can lead to misjudging exposure or applying mitigations to the wrong equipment. Before acting, verify your appliance's exact model.

Available hotfixes

SonicWall released fixes as hotfixes, distributed through SonicWall Support:

• v12.4.3-03453
• 12.5.0-02835

Applying the relevant hotfix is the first and most urgent action. Because distribution happens through the support channel, it is best to open the case as soon as possible rather than wait for a scheduled maintenance cycle.

Timeline and attribution

The flaws were discovered by the Rapid7 MDR team and disclosed on July 14, 2026. Disclosure, however, does not mark the start of the risk but the moment the problem became public: real-world exploitation began around June 22, 2026, that is, weeks before the patch.

According to the incident brief, the activity is attributed to a threat actor that Volexity tracks as UTA0533, which deployed custom malware during those weeks before the patch. This zero-day exploitation window is the most uncomfortable part of the case: during that period, any vulnerable appliance exposed to the internet could be compromised while no fix was yet available.

CISA added both vulnerabilities to its KEV (Known Exploited Vulnerabilities) catalog, which officially confirms active exploitation and, for organizations subject to its directives, turns patching into a deadline-bound obligation.

Why SSL-VPN concentrators are a prime target

SSL-VPN and remote access appliances are, by design, internet-facing devices: their whole job is to accept inbound connections from anywhere. That exposure makes them a prime initial-access target, both for ransomware operators and espionage actors. A compromised concentrator is not an end in itself but a pivot into the internal network.

Three factors together explain why attackers favor this class of equipment. First, they are always reachable from outside. Second, they usually have privileged network routes into internal systems. Third, when the entry vulnerability is pre-auth, the target can be located en masse. Understanding this dynamic is central to attack surface management (ASM/EASM): knowing exactly which perimeter devices you have exposed and on what version.

From the appliance to the internal network

Once an attacker executes code on the appliance, they inherit its network position. From there they can attempt lateral movement, credential theft from active VPN sessions or persistence through custom malware. Understanding this progression is the goal of internal and external infrastructure penetration testing: validating not just whether the perimeter gives way, but what can be reached afterwards.

What to do if you have an exposed SMA 1000

The response should be ordered by priority. The first action is to apply the relevant hotfix (v12.4.3-03453 or 12.5.0-02835) through SonicWall Support, after confirming the appliance's exact model.

The second consideration is more delicate: if the appliance was exposed unpatched during the exploitation window, patching alone is not enough. You must assume compromise and act accordingly. At a minimum, that means:

• Looking for signs of custom malware on the appliance.
• Reviewing unauthorized configuration changes.
• Rotating all credentials that may have been exposed, including VPN session and administration credentials.
• Treating the appliance as a potential pivot point and inspecting the internal network for lateral movement.

The reasoning is clear: a patch closes the door but does not evict whoever already got in. When there was an active exploitation window, the prudent working hypothesis is that an attacker may have used it.

Fitting the incident into continuous defense

Cases like this show why perimeter security cannot be reduced to patching when an advisory is published. Early detection of exposures, prioritization by real-world exploitability and continuous validation are the pillars of a continuous threat exposure management (CTEM) approach. A CTEM program would have flagged an exposed SMA 1000 as a high-risk asset long before the CVE was published.

Frequently asked questions

What is the difference between the SMA 1000 series and the SMA 100 series?

They are different SonicWall Secure Mobile Access product lines. These vulnerabilities (CVE-2026-15409 and CVE-2026-15410) affect the SMA 1000 series, specifically models 6210, 7210 and 8200v. Confusing the two series can lead to misjudging exposure or mitigating the wrong equipment, so always verify the exact model.

Why does CVE-2026-15409 score CVSS 10 if it is "only" an SSRF?

Because it is a pre-authentication SSRF on a perimeter device. It requires no credentials, is reachable by an unauthenticated remote attacker and acts as the initial link of a chain that ends in code execution. The lack of an authentication requirement, combined with the appliance's privileged position, justifies the maximum score.

Is applying the hotfix enough?

Applying the hotfix (v12.4.3-03453 or 12.5.0-02835) is essential, but not always sufficient. If the appliance was exposed unpatched during the exploitation window, you must assume compromise: hunt for custom malware, review configuration changes and rotate credentials. A patch closes the vulnerability, but it does not reverse access already obtained.

Since when were these flaws being exploited?

According to the incident analysis, real-world exploitation began around June 22, 2026, weeks before the public disclosure on July 14, 2026. During that period they were used as zero-days, with no fix available. The activity is attributed to an actor that Volexity tracks as UTA0533.

How do I know if my appliance is exposed to the internet?

An SSL-VPN concentrator is, by function, reachable from outside. You can check your exposure from the attacker's perspective with internet-connected device discovery tools and, more systematically, with an attack surface management program that inventories all your perimeter assets and their versions.

Why are VPN devices such a frequent target?

Because they combine permanent internet exposure, privileged network routes into internal systems and, when the vulnerability is pre-auth, the ability to locate and exploit them en masse. A compromised appliance works as a pivot into the internal network, which makes them especially attractive for initial access in ransomware and espionage operations.

Related resources

• What SSRF (Server-Side Request Forgery) is
• What a CVE is
• What an exploit is
• Internal and external infrastructure penetration testing
• What Shodan is
• Attack surface management (ASM/EASM)
• What CTEM (continuous threat exposure management) is

Secra helps you validate your exposure

At Secra we are an offensive security company with our own vulnerability research program. We have discovered and published CVEs in NVD and INCIBE-CERT, such as CVE-2025-40652 in CoverManager and CVE-2023-3512 in Setelsa ConacWin CB. That research work is the same rigor we bring when we audit a client's infrastructure.

If you have remote access appliances exposed to the internet and want to know, from an attacker's perspective, what can actually be reached in your network, we can help. We audit your perimeter, validate your exposure and prioritize fixes by real-world exploitability. Get in contact with us.