CVE-2026-15409 & CVE-2026-15410: Inside the SonicWall SMA 1000 Zero-Day Chain

What's Affected

SonicWall Secure Mobile Access (SMA) 1000 series appliances, both physical and virtual editions, running firmware versions prior to the emergency patch released this week. The SMA 1000 is a widely deployed SSL-VPN and remote access gateway, which makes it a high-value target for initial access into enterprise networks.

The Two Vulnerabilities

CVE-2026-15409, CVSS 10.0: Server-Side Request Forgery (SSRF) in the SMA 1000 management interface. An unauthenticated attacker can craft a request that causes the appliance to make arbitrary internal network calls on its behalf, effectively turning the SMA appliance into a pivot point into the internal network segments it's meant to protect.

CVE-2026-15410, CVSS 7.2: Post-authentication code injection. Once an attacker has any valid session, including one obtained through the SSRF pivot or through separately compromised credentials, a flaw in request handling allows arbitrary code execution on the underlying OS.

Attack Chain Breakdown

Step one, reconnaissance: the attacker identifies an internet-facing SMA 1000 management interface, commonly exposed on 443/tcp or a dedicated management port.

Step two, initial access via SSRF: the attacker sends a crafted request to the vulnerable endpoint, which the appliance processes without authentication, allowing internal service discovery and potential credential or session token harvesting from internal-only management APIs.

Step three, escalation via code injection: using a session obtained in step two, or through separately compromised credentials, the attacker submits a malicious payload to a post-auth endpoint vulnerable to code injection, resulting in command execution in the context of the appliance's service account.

Step four, persistence and pivoting: from appliance-level code execution, attackers can modify VPN configurations, harvest additional credentials from connected directory services, and use the compromised appliance as a foothold into the internal network the SMA was meant to gatekeep.

This chaining pattern is consistent with prior SonicWall SMA exploitation seen in past campaigns, where edge devices are used as a stepping stone rather than an end target.

Indicators to Check For

SonicWall's advisory does not, as of publication, include a published IOC list, so treat the following as investigative leads rather than confirmed indicators of compromise: unexpected outbound connections from the SMA appliance to internal-only hosts or services it wouldn't normally reach; anomalous authentication events on the management interface, especially from unfamiliar source IPs or at unusual hours; unexpected changes to VPN policies, local admin accounts, or scheduled tasks on the appliance; and spikes in requests to the management interface prior to any successful authentication.

Remediation

Apply SonicWall's emergency firmware update for the SMA 1000 series immediately. This is the primary fix; there is no full mitigation without patching. If immediate patching isn't possible, restrict access to the management interface to a trusted IP allowlist and disable any direct internet exposure of that interface. Review VPN and management-interface authentication logs for the two weeks prior to patching for the anomalies listed above. Rotate credentials for any accounts with access to the SMA management interface as a precaution. If compromise is suspected, treat the appliance as untrusted: rebuild from a known-good firmware image rather than attempting to clean an infected system in place, and rotate all credentials that touched the appliance.

Related

This post is part of this week's Security Roundup: SonicWall Zero-Days, Microsoft's Record Patch Tuesday, and the Klue Breach Fallout (Week of July 13, 2026), at colibrisec.org/security-roundup-sonicwall-microsoft-klue-july-13-2026/.