What happened (short and spicy)

Heads-up: SonicWall says attackers have been poking at two nasty flaws in the SMA1000 appliances. One is a critical SSRF that lets an unauthenticated stranger make the appliance reach places it shouldn’t (CVE-2026-15409, CVSS 10.0). The other is a post-authentication code injection bug (CVE-2026-15410, CVSS 7.2) that lets a logged-in admin run arbitrary OS commands. Even though the second one needs admin credentials, the vendor rated the whole advisory with a blanket CVSS score of 10.0.

The company investigated multiple incidents and confirmed these bugs are being actively used in the wild, so this is not theoretical — it’s real and happening now.

What to check and what to do

Affected models: SMA1000 series 6210, 7210, and 8200v running certain platform-hotfix releases. The vulnerable builds include 12.4.3-03245, 12.4.3-03387, 12.4.3-03434, 12.5.0-02283, 12.5.0-02624, and 12.5.0-02800. Fixes are available in platform-hotfix versions 12.4.3-03453 and 12.5.0-02835 and in later releases. These issues do not affect SSL‑VPN on SonicWall firewalls or the SMA 100 Series.

There are no effective workarounds—your best move is to install hotfixes immediately if you run affected firmware.

Use these indicators of compromise (IOCs) to sniff for trouble in your appliance logs and configuration:

  • extraweb_access.log shows requests to /__api__/login or /__api__/logout returning HTTP 200 (those URIs shouldn’t behave like that)
  • extraweb_access.log shows requests to /wsproxy with odd host parameters and HTTP 101 responses
  • ctrl-service.log contains hotfix rollback entries with suspicious path traversal names
  • /var/lib/unit/conf.json contains routes for /__api__/login or /__api__/logout (these endpoints aren’t part of a legit config)

If any of the above signs appear, treat the box as compromised. Recommended recovery steps:

  • Re-image physical appliances or redeploy virtual appliances from a clean image
  • Change all user and administrator passwords
  • Reset all TOTP (time‑based) tokens and re-enroll MFA devices
  • Perform a thorough log and configuration review to understand the scope of the intrusion

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added both CVEs to its Known Exploited Vulnerabilities catalog, and federal agencies have a binding directive to remediate or remove affected systems by July 17, 2026. In short: don’t procrastinate.

Quick summary: these are serious, actively exploited bugs in SMA1000 appliances. Patch now, scan for the IOCs above, and assume compromise if you see evidence — then rebuild and rotate secrets.