SonicWall SMA1000: Two Rounds of Exploited Zero-Days

What to do

1. Check every SMA1000's firmware build; anything at or below 12.4.3-03453 or 12.5.0-02835 is exposed to the September pair.
2. Install platform-hotfix 12.4.3-03526 or 12.5.0-02952 (or later) from mysonicwall.com.
3. Review the appliance for the July indicators below and open a SonicWall support case to check for September indicators.
4. If anything matches, re-image (hardware) or re-deploy (virtual) the appliance, change all user and administrator passwords, and reset TOTP tokens.
5. Rotate directory (LDAP/AD) service credentials the appliance uses, and keep the Appliance Management Console off untrusted networks.
6. Monitor SMA1000 appliances for unexpected inbound and outbound connections.

How to check if you are affected or compromised

• In /var/log/aventail/extraweb_access.log, look for /wsproxy requests answered with HTTP 101 that carry suspicious host parameters or bmID values starting with -3389, and HTTP 200 responses to /__api__/login or /__api__/logout.
• Check /var/lib/unit/conf.json for routes for /__api__/login or /__api__/logout (proxied to http://127.0.0.1:8085); SonicWall says these URIs do not exist in a legitimate configuration.
• Search /var/log/aventail/ctrl-service.log for hotfix rollbacks with path traversal names such as ../../../../../tmp/1234.sh.
• Look for /usr/bin/xzfind, deploy_new.py, agent_wp8.jar or agent_wp9.jar, unexpected setuid binaries (find / -perm -4000), and stray files in /tmp and /var/tmp.

What happened#

SonicWall's SMA1000 remote-access appliances have been attacked twice in 2026, each time through the same kind of pairing: an unauthenticated server-side request forgery (SSRF) in the Work Place portal plus a command injection in the Appliance Management Console (AMC).

On July 14, SonicWall published SNWLID-2026-0008 for CVE-2026-15409 (SSRF, CVSS 10.0) and CVE-2026-15410 (post-authentication code injection, CVSS 7.2). Its PSIRT said it had "investigated multiple cases indicating the active exploitation." CISA added both to the KEV catalog the same day and now marks them as used in ransomware campaigns. Volexity traced the earliest compromise to June 22. The actor, which Volexity tracks as UTA0533, abused /wsproxy to tunnel into localhost-only services such as CouchDB and the control service. It then called sysCtrl.execRemoveHotfix with a traversal path to run a script as root. After that it deployed custom implants, including KNUCKLEBALL, a suo5-based proxy, the ORANGETAIL webshell and the ROOTRUN setuid helper, and on one appliance sniffed LDAP traffic for credentials.

On September 1, SNWLID-2026-0016 added CVE-2026-83548, a pre-authentication SSRF through an "unintended alternate access path" (CVSS 10.0), and CVE-2026-83549, an OS command injection in the AMC (vendor CVSS 7.8). SonicWall again confirmed a case of active exploitation. Rapid7 notes that the two can be chained into unauthenticated remote code execution. CISA listed both in KEV on September 2.

Who is affected#

SMA1000 models 6210, 7210 and 8200v (virtual) are affected. The September advisory lists 12.4.3-03453 and 12.5.0-02835 as vulnerable, and those are exactly the builds that fixed the July bugs. An appliance patched promptly in July was therefore still exposed in September. The fixed builds for all four CVEs are 12.4.3-03526 and 12.5.0-02952. SonicWall states that SSL-VPN on its firewalls and the SMA 100 series are not affected. The CVE-2026-15409 and CVE-2026-83548 records carry CISA's "Exploitation: active, Automatable: yes" assessment.

Do you really need to act?#

If you own one of these boxes, yes, today. The front half of each chain needs no credentials, and the portal is internet-facing by design. Attackers have had working exploits since at least June. BleepingComputer reported Shadowserver tracking over 380 exposed SMA1000 appliances in August and Resecurity linking the July attacks to an INC Ransomware affiliate. Volexity says the July actor had limited success moving deeper into victim networks, but an owned VPN concentrator still leaks credentials and session data.

Patching alone does not answer whether you were already compromised. Both advisories say no workaround exists and tell customers to hunt and, if needed, rebuild. Most development teams don't run SMA1000. If you don't, nothing here needs your time.

What to do now#

1. Record the firmware build of every SMA1000 from the AMC.
2. Install platform-hotfix 12.4.3-03526 or 12.5.0-02952 (or newer) from mysonicwall.com. Skipping straight from a pre-July build is fine, since the September builds cover all four CVEs.
3. Run the July checks below, and open a SonicWall support case to review the appliance for September indicators, as SonicWall recommends.
4. On any hit, re-image or re-deploy the appliance, change all user and admin passwords, and reset TOTP tokens. Rotate the LDAP/AD bind accounts the appliance uses too.
5. Keep the AMC reachable only from an admin network, and alert on unusual outbound connections from the appliance.

How to tell if you were hit#

For the July chain, SonicWall and Volexity point to /var/log/aventail/extraweb_access.log. Look for /wsproxy requests answered with HTTP 101 that carry suspicious host parameters or bmIDs beginning with -3389, and 200 responses for /__api__/login or /__api__/logout. Next, check /var/lib/unit/conf.json for routes for those URIs pointing to 127.0.0.1:8085; they never appear in a clean configuration. Search ctrl-service.log for hotfix rollbacks with traversal paths. On disk, look for /usr/bin/xzfind, deploy_new.py, /tmp/agent_wp8.jar and /tmp/agent_wp9.jar, and review unexpected setuid files with find / -perm -4000. Volexity has published YARA rules. SonicWall has not published IOCs for the September pair as of October 21, 2026, so get a support review.

Timeline#

• Jun 22, 2026 — Earliest compromise Volexity observed.
• Jul 14, 2026 — SonicWall publishes SNWLID-2026-0008 with hotfixes 12.4.3-03453 and 12.5.0-02835. CISA adds CVE-2026-15409 and CVE-2026-15410 to KEV.
• Jul 17, 2026 — Volexity publishes the exploitation chain and malware details.
• Aug 10, 2026 — BleepingComputer reports that CISA now flags both CVEs as used by ransomware gangs.
• Sep 1, 2026 — SonicWall publishes SNWLID-2026-0016 (CVE-2026-83548, CVE-2026-83549) with hotfixes 12.4.3-03526 and 12.5.0-02952.
• Sep 2, 2026 — CISA adds the September pair to KEV.

Vulnerability records

• CVE-2026-15409 · KEV 2026-07-14 · A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface.
• CVE-2026-15410 · KEV 2026-07-14 · Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console…
• CVE-2026-83548 · KEV 2026-09-02 · A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path.
• CVE-2026-83549 · KEV 2026-09-02 · Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. SonicWall PSIRT — SNWLID-2026-0008: SMA1000 Series Appliances Affected By Multiple Vulnerabilities psirt.global.sonicwall.com
2. SonicWall PSIRT — SNWLID-2026-0016: SMA1000 Series Appliances Affected By Multiple Vulnerabilities psirt.global.sonicwall.com
3. CVE record — CVE-2026-15409 cve.org
4. CVE record — CVE-2026-83548 cve.org
5. CISA — Known Exploited Vulnerabilities: CVE-2026-15409 cisa.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2026-83548 cisa.gov
7. Volexity — Proxying to Compromise: SonicWall Secure Mobile Access 0-Day Exploitation volexity.com
8. Rapid7 — Critical SonicWall SMA1000 vulnerabilities (CVE-2026-83548, CVE-2026-83549) exploited in the wild rapid7.com

Coverage and analysis

1. BleepingComputer — SonicWall SMA1000 flaws exploited as zero-days to push custom malware bleepingcomputer.com
2. BleepingComputer — CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs bleepingcomputer.com