First Seen: July 2026

Affected Products: SonicWall SMA1000 Series (models 6210, 7210, and 8200v)

SonicWall has warned that attackers are actively exploiting two zero-day flaws in its SMA1000 Series remote access appliances. The first, CVE-2026-15409, is a critical flaw (CVSS 10.0) that lets an attacker with no login reach services that are meant to stay hidden inside the appliance. The second, CVE-2026-15410, then lets them run their own commands as the top-level "root" user, which means full control of the device. Both vulnerabilities are confirmed as actively exploited, and because there are no workarounds, organizations running affected SonicWall SMA1000 appliances should treat patching and forensic review as an emergency.

CVEs at a Glance

#1 — Server-Side Request Forgery in WorkPlace (CVE-2026-15409)

SonicWall has warned of active exploitation of two zero-day vulnerabilities impacting its Secure Mobile Access (SMA) 1000 Series appliances. The first and most severe, CVE-2026-15409, is a server-side request forgery weakness (CWE-918) in the SonicWall SMA1000 WorkPlace application. The problem lives in a websocket proxy feature reachable at the /wsproxy path. This feature works like a netcat-style TCP tunnel and takes the target host and port directly from user-supplied URL parameters. By pointing those parameters at the loopback address, an unauthenticated attacker can send and receive raw TCP traffic to and from services that are only meant to be reachable locally on the SonicWall SMA1000 appliance.

#2 — Loopback Access to Internal Services

That local reach is what makes the CVE-2026-15409 flaw so dangerous. Once inside the loopback boundary, an attacker can talk to less-hardened internal services, such as an Erlang process on port 1050 or the ctrl-service application on port 8188. In testing, researchers reached the Erlang service and achieved code execution using a hardcoded cookie value, meaning authentication was not actually required to run commands. This is the first-stage foothold that was observed being exploited in the wild against SonicWall SMA1000 appliances.

#3 — Code Injection via remove_hotfix Path Traversal (CVE-2026-15410)

The second flaw, CVE-2026-15410, is an improper control of code generation issue (CWE-94) in the Appliance Management Console. It is a path traversal in the remove_hotfix workflow for ctrl-service, accessible via the web console. An attacker supplies a hotfix value containing a traversal sequence that points to a malicious script they have already staged on the device. The system then makes the script executable and runs it as root before rebooting the appliance. If the referenced file does not exist, no reboot happens; if it does exist, the appliance chmods and executes it under UID 0. This turns the earlier low-privileged code execution into full root control of the SonicWall SMA1000 appliance.

#4 — Impact, Affected Versions, and Exploitation Outlook

The two vulnerabilities give an unauthenticated remote attacker a clean path from the public internet to root on the SonicWall SMA1000 appliance. The impact is limited to the SMA1000 Series; SonicWall has confirmed these issues do not affect SSL VPN functionality on SonicWall firewalls or the SMA 100 Series product line. The affected software covers SMA1000 Series models 6210, 7210, and 8200v running builds 12.4.3-03245, 12.4.3-03387, and 12.4.3-03434, as well as 12.5.0-02283, 12.5.0-02624, and 12.5.0-02800. A public proof-of-concept for CVE-2026-15409 already exists, and a Metasploit module for the full chain is reportedly in development, so exploitation of SonicWall SMA1000 appliances is expected to broaden quickly.

Affected Versions, CPEs, and CWEs

Patch Link

• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008

References

• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008
• https://github.com/remmons-r7/rapid7-CVE-2026-15409