SonicWall Patches Two Chained SMA1000 Zero-Days as CISA Sets a July 17 Deadline for Federal Agencies
CVE-2026-15409 and CVE-2026-15410 were exploited together against SMA1000 appliances before patches shipped, CISA says.
Overview
SonicWall has shipped emergency hotfixes for two SMA1000 vulnerabilities after confirming active exploitation in the wild, according to BleepingComputer. Rapid7 says its Managed Detection and Response team observed the exploitation before SonicWall’s public disclosure, according to Rapid7. The U.S. Cybersecurity and Infrastructure Security Agency has ordered federal civilian agencies to secure affected systems by July 17, 2026, giving them a three-day window from the July 14 disclosure, according to BleepingComputer.
What We Know
The more severe of the two flaws, CVE-2026-15409, is a server-side request forgery vulnerability in the SMA1000 Appliance Work Place interface. NVD describes it this way: “A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.” The flaw carries a maximum CVSS v3.1 base score of 10.0. The second flaw, CVE-2026-15410, is a post-authentication code injection bug in the SMA1000 Appliance Management Console. NVD describes it as a vulnerability that “in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands,” rated 7.2 on the CVSS scale.
The two bugs did not stay separate in the wild. Help Net Security reports: “In attacks observed so far, the two bugs are being exploited in tandem.” That combination lets an unauthenticated attacker use the SSRF flaw to reach the appliance and the code-injection flaw to run commands as administrator once inside. SonicWall confirmed active exploitation directly: “SonicWall PSIRT has investigated multiple cases indicating the active exploitation of the vulnerabilities described in this advisory,” the company said, according to BleepingComputer.
The exploitation predates SonicWall’s public disclosure. Rapid7 says its Managed Detection and Response team “observed active, targeted zero-day exploitation of internet-facing SMA 1000-series appliances” prior to SonicWall’s official advisory. Once attackers gained a foothold, Rapid7 says “the actors systematically extracted high-value credentials, active session databases, and Time-Based One-Time Password (TOTP) multi-factor authentication (MFA) seed configurations” — a haul that would let an intruder bypass multi-factor authentication on other systems tied to the same credentials. Rapid7 also describes the SSRF mechanism directly: “By providing host values that point to localhost, the attacker can access local SonicWall appliance system services behind the firewall to send and receive arbitrary TCP traffic to and from them.”
The affected hardware spans the SMA1000 series models 6210, 7210, and 8200v, according to both BleepingComputer and SecurityWeek. SonicWall shipped platform hotfixes 12.4.3-03453 and 12.5.0-02835 to close both holes, per BleepingComputer. A company spokesperson, quoted by Help Net Security, said: “We have confirmed that these vulnerabilities are being actively exploited in the wild and are not unique to SonicWall.” The spokesperson stressed that “patching alone is not sufficient,” urging customers to review logs for indicators of compromise even after updating.
SonicWall credited Adam Babis of its own Product Security Incident Response Team with discovering and reporting the flaws, and acknowledged Volexity researchers Sean Koessel and Steven Adair for helping advance the internal investigation and identifying an additional indicator of compromise, according to The Hacker News.
The federal deadline follows a pattern The Machine Herald has tracked through 2026, in which CISA has repeatedly compressed patch windows to three days for the riskiest combination of internet exposure, KEV-catalog listing, exploit automation, and total-compromise impact under Binding Operational Directive 26-04. BleepingComputer reports: “Federal agencies have until July 17, 2026, to secure affected systems under Binding Operational Directive (BOD) 26-04 or discontinue use of the product if mitigations cannot be applied.” The Hacker News similarly reports that CISA’s addition of the two flaws to its Known Exploited Vulnerabilities catalog requires “Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by July 17, 2026.” NVD’s own record for CVE-2026-15410 lists a CISA KEV due date of July 17, 2026, sourced directly from CISA.
What We Don’t Know
Neither SonicWall nor the outlets that have reported on the incident have named the threat actor or actors behind the exploitation. It also remains unclear how many organizations were compromised before hotfixes became available, or how long the zero-day exploitation window lasted before Rapid7’s detection.
Analysis
The SonicWall case illustrates why CISA moved away from a pure severity-score model earlier this year. CVE-2026-15409 alone would qualify for the fastest response tier under BOD 26-04: it sits on an internet-facing interface, was added to the KEV catalog, and — chained with CVE-2026-15410 — hands an attacker administrator-level command execution, the kind of total-compromise outcome the directive was built to catch. That the exploitation was already under way before SonicWall’s advisory, per Rapid7’s account, underscores the directive’s compromise-assessment requirement: patching the two hotfixes closes the hole, but it does not by itself remove an attacker who established a foothold and harvested credentials and MFA seeds beforehand.