SonicWall SMA1000 gateways under active exploitation of critical flaws

SonicWall has issued an urgent warning that two critical vulnerabilities – CVE‑2026‑15409 (a server‑side request forgery) and CVE‑2026‑15410 (a post‑authentication code‑injection) – in its SMA1000 Series appliances are being actively exploited in the wild. The SSRF flaw carries a CVSS v3 score of 10.0, while the code‑injection flaw scores 7.2, both potentially enabling remote code execution and bypass of security controls.

The defects affect SMA1000 models 6210, 7210 and 8200v running various firmware versions. SonicWall released hot‑fixes (including 12.4.3‑03453 and 12.5.0‑02835) and provided indicators of compromise for customers to detect abuse. The company recommends forensic investigations, re‑imaging or redeploying affected appliances, changing all passwords and resetting TOTP tokens. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerabilities to its Known Exploited Vulnerabilities Catalog.