SonicWall SMA1000 Under Active Attack — CVE-2026-15409 & 15410 in CISA KEV, Patch Now

On July 14, 2026, the U.S. agency CISA added two vulnerabilities in SonicWall's "SMA1000 series" — access appliances used to safely connect from outside into an internal network — to its catalog of vulnerabilities under active real-world attack (KEV). They are CVE-2026-15409 and CVE-2026-15410, and CISA ordered U.S. federal agencies to act by July 17 — just three days later.

SMA1000 is the gateway employees use to reach internal systems from the road or from home. Because it sits directly on the internet, breaking this gateway leads straight to intrusion into the internal network. VPN appliances are a favored entry point for ransomware attacks, and "confirmed exploited" means this cannot be deferred. Organizations that use it should check for SonicWall's latest fix right now.

Note that as of writing, both are still "RESERVED" in the NVD (the U.S. NIST vulnerability database), so the CVSS severity numbers and the exact fixed build numbers have not caught up in publication. What is certain is that CISA has designated both as "under real-world attack" and demanded urgent action. The technical breakdown below follows the CISA KEV entries and SonicWall's notices.

Who targets this, and what they try to do

The ones exploiting this are attackers who mechanically scan for SonicWall SMA1000 appliances exposed on the internet and try to pry open the gateway into the internal network. VPN appliances in particular are a favored first step for ransomware crews: they are always visible from outside and lead deep inside.

What they aim to do is first use the unauthenticated SSRF (CVE-2026-15409) to make the appliance carry out internal-facing requests on their behalf, then use administrator-level code execution (CVE-2026-15410) to run their own commands on it. SSRF (server-side request forgery) tricks the appliance into reaching "places it shouldn't be able to reach" on the attacker's behalf. On its own it looks minor, but it becomes a foothold for probing internal information and other weaknesses, and chaining several holes together can reach full takeover of the appliance. On SonicWall's SMA1000, attacks that combine an unauthenticated hole with a management-side hole to seize administrator rights have been observed before.

If the appliance is taken over, the losses are large. Because a VPN is the gateway between outside and inside, controlling it leads straight to stealing employee logins, intruding into the internal network, and deploying ransomware from there. For end users, remote work and connections stop; for the operating company, the production environment itself is put at risk. That is why CISA set a deadline of just three days.

What SonicWall SMA1000 is

SMA1000 (Secure Mobile Access 1000) is SonicWall's enterprise remote-access appliance. It acts as the "gateway" for employees to connect safely to company systems and apps from outside, providing what's called SSL-VPN (entering the internal network over encrypted communication). It is used in environments where many users connect at once, such as large companies and government offices.

By its very role, this kind of appliance is always exposed to the internet. It sits where anyone can attempt a connection, and it leads to critical internal systems, so it is a cost-effective target for attackers. In recent years — not only SonicWall but Fortinet, Citrix, Ivanti and others — VPN and remote-access appliance flaws have been exploited repeatedly, becoming the starting point for large data breaches and ransomware. SMA1000 is no exception.

Inside the two vulnerabilities

CVE-2026-15409: unauthenticated SSRF that makes the appliance send rogue requests

Per the CISA KEV entry, this is a server-side request forgery (SSRF) flaw where "a remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location." No login is needed; it can be hit directly from outside. Attackers can use it to reach, indirectly and via the appliance, internal services or management functions not normally visible from outside. SSRF alone does not immediately mean takeover, but it is used for reconnaissance and to build a foothold for the next stage.

CVE-2026-15410: code injection that runs OS commands as administrator

The other, per CISA KEV, is a code-injection flaw where "in specific conditions a remote authenticated attacker as administrator could execute arbitrary OS commands." It differs from 15409 in that exploitation requires administrator authentication — but the danger is when these two (or other holes, or stolen credentials) are combined. With a hole that builds an unauthenticated foothold plus a hole that runs code as administrator, an attacker can step toward full control of the appliance. On SonicWall SMA1000, exactly this kind of chaining of an "unauthenticated entry" with "management-side code execution" has been observed before.

Why VPN appliances keep getting targeted

There are clear reasons VPN and remote-access appliances are hit again and again. First, they are always exposed to the internet, found by attackers simply sweeping IP addresses. Second, they are where the credentials and traffic for entering the internal network converge, so seizing one lets attackers push deep inside at once. Third, being dedicated appliances, their updates tend to be deferred, and fixes go unapplied.

SonicWall SMA1000 also had a critical unauthenticated hole in 2025 (CVE-2025-23006 at the time) combined with a privilege-escalation hole and exploited to seize administrator rights without authentication. Security researchers reported that around 950 SMA1000 appliances were exposed on the internet at the time. The new CVE-2026-15409 / 15410 are likewise on KEV as "confirmed exploited," and the pattern of unpatched appliances being targeted has not changed.

What to do now

The top priority is to update your SonicWall SMA1000 to the latest fix (platform-hotfix) that SonicWall points to, immediately. These two are already under exploitation, leaving no room to defer for testing. CISA imposed a July 17 deadline on federal agencies; private companies should use that date as a yardstick for their own emergency response.

One caution: confirm the exact fixed build for these CVEs on SonicWall's official advisory (SonicWall PSIRT). SMA1000 fixes ship as hotfixes on the 12.4.x and 12.5.x lines, but which build closes these two depends on your appliance's line. Rather than guessing a number, match your model against the latest version in the vendor's guidance.

Beyond updating, check the following. First, review whether SMA1000 really needs to be exposed to the internet, and restrict things like the management interface from external reach as much as possible. Second, check whether you have already been breached. Since exploitation is underway, an update prevents further intrusion but does not guarantee you weren't already breached. Look for unfamiliar administrator accounts, configuration changes, or suspicious traffic, and if anything is doubtful, rotate credentials and investigate. You can also track exploitation on our CISA KEV dashboard (Japanese).

Summary

On July 14, 2026, CISA added SonicWall SMA1000 flaws CVE-2026-15409 (unauthenticated SSRF) and CVE-2026-15410 (OS command execution as administrator) to KEV as under real-world attack, and required federal agencies to act by July 17. SMA1000 is the VPN gateway from outside into the internal network; if breached, it becomes a starting point for internal intrusion and ransomware.

What to do is clear: update to SonicWall's latest fix immediately, and confirm the exact build number on SonicWall PSIRT. Also review external exposure and check whether you have already been breached. NVD's detailed publication has not caught up, but "confirmed exploited, with a short deadline imposed on federal agencies" is by itself reason enough to move fast.

FAQ

Sources

• ▸CISA - Known Exploited Vulnerabilities Catalog (CVE-2026-15409 / 15410 added July 14, 2026)
• ▸SonicWall PSIRT - Security Advisories (official; where to confirm the fixed build)
• ▸NVD - CVE-2026-15409 (SSRF; reserved as of writing)
• ▸NVD - CVE-2026-15410 (code injection; reserved as of writing)
• ▸BleepingComputer - reporting on SonicWall SMA1000 zero-day exploitation (background on prior chained attacks)