On 14 July 2026 SonicWall published advisory SNWLID-2026-0008 for two flaws in its SMA1000 remote access appliances, and CISA added both to the Known Exploited Vulnerabilities catalog the same day. Attacks had started before any fix was public, and SonicWall's own wording is blunt: "patching alone is not sufficient."
What's affected
SMA6210, SMA7210 and SMA8200v appliances on firmware 12.4.3-03245, 12.4.3-03387, 12.4.3-03434, 12.5.0-02283, 12.5.0-02624 or 12.5.0-02800. Fixed hotfix builds are 12.4.3-03453 and 12.5.0-02835.
- CVE-2026-15409: server side request forgery in the Work Place interface, reachable without authentication, CVSS 10.0.
- CVE-2026-15410: code injection in the Management Console that needs administrator access, CVSS 7.2. It allows OS command execution.
Attackers chained them: the SSRF to get in, the code injection to run commands. Rapid7 reported that attackers stole credentials, active session databases and TOTP MFA seeds, and that compromised appliances made Active Directory authentications to domain controllers under non-corporate client names such as "kali".
What to do now
- Install 12.4.3-03453 or 12.5.0-02835.
- Check for indicators of compromise using SonicWall's guidance and script, then review logs from the period before you patched.
- If you find any, re-image the hardware or redeploy the virtual appliance, change user and admin passwords, and reset TOTP tokens.
- Review domain controller logs for LDAP service account logins from odd client names.
How this could have been avoided
- Assume the edge device is breached between disclosure and cleanup. The attackers stole session data and MFA seeds, so patching leaves their access intact. Plan rotation of every secret the appliance held.
- Restrict the management console. CVE-2026-15410 needed admin access, which the SSRF supplied. Management should be reachable only from an admin network.
- Alert on service account logins from unusual hosts. The appliance's LDAP account authenticating from a client named "kali" is an obvious signal if anyone watches for it.
- Keep TOTP seeds off the gateway where you can. Seeds stored on the device are stolen with it.
Quick check
Why is installing the hotfix not enough?
Exploitation began before fixes were public, and attackers took credentials, session databases and TOTP seeds. Those stay valid until you rotate them and re-image compromised appliances.
