---
title: "SonicWall SMA1000: Two Rounds of Exploited Zero-Days"
url: https://erroneo.us/security/briefs/sonicwall-sma1000-zero-days-cve-2026-15409-83548/
description: "SMA1000 VPN appliances hit by exploited SSRF + command-injection chains in July and again in September. Install 12.4.3-03526 or 12.5.0-02952 and hunt for IOCs."
type: security-brief
section: "Security Digest"
date_published: 2026-07-14
date_modified: 2026-09-02
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-15409", "CVE-2026-15410", "CVE-2026-83548", "CVE-2026-83549"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# SonicWall SMA1000: Two Rounds of Exploited Zero-Days

**Verdict: Act now.** If you run an SMA1000 appliance, install the September hotfix and check it for compromise today; the July fix alone does not cover the second pair of exploited bugs.

- **Who must act:** Anyone operating SonicWall SMA1000 (6210, 7210, 8200v) appliances on 12.4.3-03453 / 12.5.0-02835 or older, physical or virtual.
- **Who can relax:** SonicWall firewall SSL-VPN and SMA 100 series users, which SonicWall says are not affected, and organizations with no SMA1000 in their estate.
- **Affected:** SMA1000 12.4.3 up to and including 12.4.3-03453 (platform-hotfix); SMA1000 12.5.0 up to and including 12.5.0-02835 (platform-hotfix); Builds 12.4.3-03434 / 12.5.0-02800 and older are also vulnerable to CVE-2026-15409 and CVE-2026-15410
- **Fixed:** SMA1000 12.4.3-03526 (platform-hotfix) and later (all four CVEs); SMA1000 12.5.0-02952 (platform-hotfix) and later (all four CVEs); 12.4.3-03453 / 12.5.0-02835 fix only CVE-2026-15409 and CVE-2026-15410
- **CVEs:** CVE-2026-15409, CVE-2026-15410, CVE-2026-83548, CVE-2026-83549
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check every SMA1000's firmware build; anything at or below 12.4.3-03453 or 12.5.0-02835 is exposed to the September pair.
2. Install platform-hotfix 12.4.3-03526 or 12.5.0-02952 (or later) from mysonicwall.com.
3. Review the appliance for the July indicators below and open a SonicWall support case to check for September indicators.
4. If anything matches, re-image (hardware) or re-deploy (virtual) the appliance, change all user and administrator passwords, and reset TOTP tokens.
5. Rotate directory (LDAP/AD) service credentials the appliance uses, and keep the Appliance Management Console off untrusted networks.
6. Monitor SMA1000 appliances for unexpected inbound and outbound connections.

### How to check if you are affected

- In /var/log/aventail/extraweb_access.log, look for /wsproxy requests answered with HTTP 101 that carry suspicious host parameters or bmID values starting with -3389, and HTTP 200 responses to /__api__/login or /__api__/logout.
- Check /var/lib/unit/conf.json for routes for /__api__/login or /__api__/logout (proxied to http://127.0.0.1:8085); SonicWall says these URIs do not exist in a legitimate configuration.
- Search /var/log/aventail/ctrl-service.log for hotfix rollbacks with path traversal names such as ../../../../../tmp/1234.sh.
- Look for /usr/bin/xzfind, deploy_new.py, agent_wp8.jar or agent_wp9.jar, unexpected setuid binaries (find / -perm -4000), and stray files in /tmp and /var/tmp.

## What happened

SonicWall's SMA1000 remote-access appliances have been attacked twice in 2026, each time through the same kind of pairing: an unauthenticated server-side request forgery (SSRF) in the Work Place portal plus a command injection in the Appliance Management Console (AMC).

On July 14, SonicWall published [SNWLID-2026-0008](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008) for CVE-2026-15409 (SSRF, CVSS 10.0) and CVE-2026-15410 (post-authentication code injection, CVSS 7.2). Its PSIRT said it had "investigated multiple cases indicating the active exploitation." CISA added both to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409) the same day and now marks them as used in ransomware campaigns. [Volexity](https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/) traced the earliest compromise to June 22. The actor, which Volexity tracks as UTA0533, abused `/wsproxy` to tunnel into localhost-only services such as CouchDB and the control service. It then called `sysCtrl.execRemoveHotfix` with a traversal path to run a script as root. After that it deployed custom implants, including KNUCKLEBALL, a suo5-based proxy, the ORANGETAIL webshell and the ROOTRUN setuid helper, and on one appliance sniffed LDAP traffic for credentials.

On September 1, [SNWLID-2026-0016](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016) added CVE-2026-83548, a pre-authentication SSRF through an "unintended alternate access path" (CVSS 10.0), and CVE-2026-83549, an OS command injection in the AMC (vendor CVSS 7.8). SonicWall again confirmed a case of active exploitation. [Rapid7](https://rapid7.com/blog/post/etr-critical-sonicwall-sma1000-vulnerabilities-cve-2026-83548-cve-2026-83549-exploited-in-the-wild) notes that the two can be chained into unauthenticated remote code execution. CISA listed both in [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-83548) on September 2.

## Who is affected

SMA1000 models 6210, 7210 and 8200v (virtual) are affected. The September advisory lists 12.4.3-03453 and 12.5.0-02835 as vulnerable, and those are exactly the builds that fixed the July bugs. An appliance patched promptly in July was therefore still exposed in September. The fixed builds for all four CVEs are 12.4.3-03526 and 12.5.0-02952. SonicWall states that SSL-VPN on its firewalls and the SMA 100 series are not affected. The [CVE-2026-15409](https://www.cve.org/CVERecord?id=CVE-2026-15409) and [CVE-2026-83548](https://www.cve.org/CVERecord?id=CVE-2026-83548) records carry CISA's "Exploitation: active, Automatable: yes" assessment.

## Do you really need to act?

If you own one of these boxes, yes, today. The front half of each chain needs no credentials, and the portal is internet-facing by design. Attackers have had working exploits since at least June. [BleepingComputer](https://www.bleepingcomputer.com/news/security/cisa-sonicwall-sma1000-flaws-now-exploited-by-ransomware-gangs/) reported Shadowserver tracking over 380 exposed SMA1000 appliances in August and Resecurity linking the July attacks to an INC Ransomware affiliate. Volexity says the July actor had limited success moving deeper into victim networks, but an owned VPN concentrator still leaks credentials and session data.

Patching alone does not answer whether you were already compromised. Both advisories say no workaround exists and tell customers to hunt and, if needed, rebuild. Most development teams don't run SMA1000. If you don't, nothing here needs your time.

## What to do now

1. Record the firmware build of every SMA1000 from the AMC.
2. Install platform-hotfix 12.4.3-03526 or 12.5.0-02952 (or newer) from mysonicwall.com. Skipping straight from a pre-July build is fine, since the September builds cover all four CVEs.
3. Run the July checks below, and open a SonicWall support case to review the appliance for September indicators, as SonicWall recommends.
4. On any hit, re-image or re-deploy the appliance, change all user and admin passwords, and reset TOTP tokens. Rotate the LDAP/AD bind accounts the appliance uses too.
5. Keep the AMC reachable only from an admin network, and alert on unusual outbound connections from the appliance.

## How to tell if you were hit

For the July chain, SonicWall and Volexity point to `/var/log/aventail/extraweb_access.log`. Look for `/wsproxy` requests answered with HTTP 101 that carry suspicious host parameters or bmIDs beginning with `-3389`, and 200 responses for `/__api__/login` or `/__api__/logout`. Next, check `/var/lib/unit/conf.json` for routes for those URIs pointing to `127.0.0.1:8085`; they never appear in a clean configuration. Search `ctrl-service.log` for hotfix rollbacks with traversal paths. On disk, look for `/usr/bin/xzfind`, `deploy_new.py`, `/tmp/agent_wp8.jar` and `/tmp/agent_wp9.jar`, and review unexpected setuid files with `find / -perm -4000`. Volexity has published YARA rules. SonicWall has not published IOCs for the September pair as of October 21, 2026, so get a support review.

## Timeline

- Jun 22, 2026 — Earliest compromise Volexity observed.
- Jul 14, 2026 — SonicWall publishes SNWLID-2026-0008 with hotfixes 12.4.3-03453 and 12.5.0-02835. CISA adds CVE-2026-15409 and CVE-2026-15410 to KEV.
- Jul 17, 2026 — Volexity publishes the exploitation chain and malware details.
- Aug 10, 2026 — BleepingComputer reports that CISA now flags both CVEs as used by ransomware gangs.
- Sep 1, 2026 — SonicWall publishes SNWLID-2026-0016 (CVE-2026-83548, CVE-2026-83549) with hotfixes 12.4.3-03526 and 12.5.0-02952.
- Sep 2, 2026 — CISA adds the September pair to KEV.

## Sources

1. [SonicWall PSIRT — SNWLID-2026-0008: SMA1000 Series Appliances Affected By Multiple Vulnerabilities](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008)
2. [SonicWall PSIRT — SNWLID-2026-0016: SMA1000 Series Appliances Affected By Multiple Vulnerabilities](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016)
3. [CVE record — CVE-2026-15409](https://www.cve.org/CVERecord?id=CVE-2026-15409)
4. [CVE record — CVE-2026-83548](https://www.cve.org/CVERecord?id=CVE-2026-83548)
5. [CISA — Known Exploited Vulnerabilities: CVE-2026-15409](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409)
6. [CISA — Known Exploited Vulnerabilities: CVE-2026-83548](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-83548)
7. [Volexity — Proxying to Compromise: SonicWall Secure Mobile Access 0-Day Exploitation](https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/)
8. [Rapid7 — Critical SonicWall SMA1000 vulnerabilities (CVE-2026-83548, CVE-2026-83549) exploited in the wild](https://rapid7.com/blog/post/etr-critical-sonicwall-sma1000-vulnerabilities-cve-2026-83548-cve-2026-83549-exploited-in-the-wild)
9. [BleepingComputer — SonicWall SMA1000 flaws exploited as zero-days to push custom malware](https://www.bleepingcomputer.com/news/security/sonicwall-sma1000-flaws-exploited-as-zero-days-to-push-custom-malware/)
10. [BleepingComputer — CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs](https://www.bleepingcomputer.com/news/security/cisa-sonicwall-sma1000-flaws-now-exploited-by-ransomware-gangs/)

---
Source page: https://erroneo.us/security/briefs/sonicwall-sma1000-zero-days-cve-2026-15409-83548/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt