CISA Warns SonicWall SMA1000 Flaws Are Exploited in Ransomware Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in SonicWall SMA1000 to its Known Exploited Vulnerabilities catalog, noting that the flaw has been used in ransomware campaigns.

This vulnerability, tracked as CVE-2026-15409, is a server-side request forgery (SSRF) issue found in the Workplace interface of SonicWall SMA1000 appliances.

It has a maximum CVSS score of 10.0. It can be exploited remotely without authentication, allowing an attacker to make requests to unintended internal or external locations.

CISA included this flaw in its catalog on July 14, 2026, with a remediation deadline set for July 17. The agency advises organizations to apply the vendor-provided mitigations in accordance with Binding Operational Directive 26-04, assess their internet exposure, and follow any applicable forensic-triage requirements.

If mitigations are unavailable, organizations should discontinue use of the affected product.

Critical SSRF and Code Injection Vulnerabilities

SonicWall’s advisory, SNWLID-2026-0008, addresses CVE-2026-15409 along with CVE-2026-15410, which is a post-authentication code injection vulnerability in the SMA1000 Appliance Management Console (AMC).

CVE-2026-15410 has a CVSS score of 7.2 and could allow an authenticated administrator to execute arbitrary operating system commands under certain conditions. This issue is classified as CWE-94, relating to improper control of code generation.

While the second vulnerability requires administrator authentication, the combination of these issues is significant for attackers.

The unauthenticated SSRF vulnerability can serve as an entry point for probing or accessing internal services, while the command execution vulnerability could facilitate persistence, payload staging, credential theft, and ransomware deployment once administrative access is achieved.

SonicWall has indicated that its Product Security Incident Response Team has investigated multiple incidents involving the active exploitation of these vulnerabilities. The company urges customers to install the available platform hotfixes immediately.

Affected Versions and Detection Guidance

The affected SMA1000 models include the 6210, 7210, and 8200v appliances running specific releases from the 12.4.3 and 12.5.0 branches. The issues are resolved in platform hotfix version 12.4.3-03453 and later, or 12.5.0-02835 and later.

It’s important to note that these vulnerabilities do not affect SSL-VPN functionality operating on SonicWall firewalls or SonicWall’s SMA 100 Series product line.

Administrators are advised to search for indicators of compromise in appliance logs and configuration files.

SonicWall has specially noted successful HTTP 200 requests to /__api__/login or /__api__/logout in extraweb_access.log, as these routes are not part of a legitimate configuration. Defenders should also investigate /wsproxy requests that contain suspicious host parameters yielding HTTP 101 responses.

Additional indicators may include hotfix rollback events featuring path-traversal-style names in ctrl-service.log, as well as unauthorized access to /__api__/login or /__api__/logout routes in /var/lib/unit/conf.json.

Organizations that identify indicators of compromise should treat the appliance as potentially fully compromised. SonicWall recommends either re-imaging hardware appliances or redeploying virtual appliances, changing all user and administrator passwords, and resetting TOTP tokens.

Given the confirmed use of ransomware, patching systems may not be sufficient if they were exposed before remediation. Security teams should preserve logs, review authentication activities, investigate outbound connections and configuration changes, and carry out a full incident-response assessment before returning affected SMA1000 appliances to production.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world