SonicWall warns of active exploits against two SMA 1000 zero-days

SonicWall has disclosed active exploitation of two zero-day vulnerabilities in its Secure Mobile Access 1000 series appliances, devices widely deployed for remote access to corporate networks.

The more severe flaw, CVE-2026-15409, carries a CVSS score of 10.0—the maximum rating—and involves a server-side request forgery vulnerability. According to SonicWall, a remote unauthenticated attacker could exploit the flaw to execute arbitrary commands on affected systems. The second vulnerability has not been detailed in the source material, but SonicWall confirmed both are under active exploitation in the wild.

The SMA 1000 series functions as a gateway for secure remote access, making it a high-value target for threat actors seeking persistent access to enterprise environments. Exploitation of CVE-2026-15409 would grant attackers administrative control without requiring credentials, enabling lateral movement, data exfiltration, or deployment of additional payloads.

• 01Organizations using SonicWall SMA 1000 face immediate risk of unauthenticated remote compromise.
• 02Threat actors may leverage admin access for lateral movement and data theft.
• 03Incident response teams should audit SMA 1000 logs for signs of prior exploitation.
• 04Managed service providers supporting SMA 1000 clients must coordinate emergency patching.