Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands

SonicWall has identified active exploitation of two zero-day vulnerabilities in its SMA 1000 series appliances. CVE-2026-15409 is a critical SSRF flaw allowing unauthenticated remote attackers to manipulate internal requests, while CVE-2026-15410 is a post-authentication code injection vulnerability enabling arbitrary command execution with administrator privileges. The U.S. CISA has added both vulnerabilities to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by July 17, 2026. Indicators of compromise include suspicious log entries and unexpected configuration changes, prompting forensic analysis and system remediation.

AI-extracted · verify before operational use