Critical SonicWall SMA1000 Vulnerabilities Under Active Exploitation

Csa.Sg

Critical SonicWall SMA1000 Vulnerabilities Under Active Exploitation

First seen 15 Jul 2026, 08:28 UTC • •87.2

Article Content

1 / 63

Browse articles

ThreatCluster •July 16, 2026 at 08:07 UTC

•Two critical vulnerabilities in SonicWall SMA1000 appliances are actively exploited.
•CVE-2026-15409 (SSRF) has a CVSS score of 10.0; CVE-2026-15410 (code injection) scores 7.2.
•Immediate patching is recommended for affected models to prevent unauthorized access.

SonicWall has reported two critical vulnerabilities, CVE-2026-15409 and CVE-2026-15410, affecting its SMA1000 Series appliances, which are currently being actively exploited. The first vulnerability, CVE-2026-15409, is a server-side request forgery (SSRF) that allows unauthenticated attackers to send requests to unintended locations, with a CVSS score of 10.0. The second, CVE-2026-15410, is a post-authentication code injection flaw that enables authenticated attackers to execute arbitrary commands, scoring 7.2 on the CVSS scale. Affected models include the SMA1000 Series 6210, 7210, and 8200v running specific firmware versions. SonicWall and CISA have urged immediate patching to mitigate risks. The vulnerabilities were added to the CISA KEV catalog on July 14, 2026, indicating confirmed exploitation in the wild. Organizations are advised to monitor for indicators of compromise and apply the necessary updates as soon as possible.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 91d ago How this analysis works

Timeline

2026-07-14

CVE-2026-15409 and CVE-2026-15410 published

SonicWall disclosed two critical vulnerabilities affecting SMA1000 appliances, with CVSS scores of 10.0 and 7.2.

Thecyberexpress

2026-07-14

Vulnerabilities added to CISA KEV catalog

CISA confirmed active exploitation of CVE-2026-15409 and CVE-2026-15410 in the wild.

2026-07-15

Public PoC released for vulnerabilities

First public proof-of-concept for CVE-2026-15409 and CVE-2026-15410 was made available.

2026-07-15

SonicWall issues urgent security advisory

SonicWall urged immediate patching for affected SMA1000 appliances due to active exploitation.

Cybersecuritynews

More articles in this cluster (62)

Following this threat?

Track Sonicwall and CVE-2026-15409 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

SonicWall Patches Critical SSRF Vulnerability in SMA1000 Appliances On October 6, 2026, SonicWall released hotfixes for four vulnerabilities in its SMA1000 series appliances, including CVE-2026-102255, a critical server-side request forgery (SSRF) flaw rated 10.0 on the CVSS scale. This vulnerability allows unauthenticated attackers to exploit an unintended access path in the…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…