Two Zero-Days on the SonicWall SMA Front Door: CVE-2026-15409 and CVE-2026-15410

SonicWall's SMA 1000 remote access gateways were exploited as zero-days by chaining two flaws: an unauthenticated request-forgery bug that tunnels inside the appliance, and an admin-side command injection that ends in root. CISA added both to KEV on July 14, and the vendor is clear that patching alone is not enough.

What the vulnerabilities are

SonicWall SMA 1000 series appliances are secure remote access, or SSL VPN, gateways built for medium to large businesses, multinationals, government agencies, and managed security service providers. They sit at the network edge and decide who is allowed to reach inside. That position is the whole point of the product, and it is also why a flaw here matters so much more than the same flaw somewhere deeper in the stack.

CVE-2026-15409 is the entry point. It is a server-side request forgery flaw in a websocket proxy feature of the SMA1000 Work Place portal, the part of the box a remote user talks to before they authenticate, reachable at the path /wsproxy on the default HTTPS port. Successful exploitation lets an unauthenticated attacker open a websocket tunnel to services that are only meant to be reachable from the appliance itself, the localhost-only services sitting behind the front door. The attacker borrows the appliance's own trusted position to reach them, all without ever logging in.

CVE-2026-15410 is the finisher. It is a code injection flaw in the SMA1000 Appliance Management Console, the administrative side of the box. An attacker who is authenticated as an administrator can inject operating system commands that the appliance runs, which yields remote code execution and, in effect, full control of the gateway. On its own this bug needs admin access, which is a meaningful bar. Chained behind the request forgery flaw, that bar gets a lot lower.

How the chain works

The reason these two are dangerous together is that each one covers the other's weakness. The code injection bug lives in the Appliance Management Console, which is powerful but gated behind an administrator session and is not meant to be reachable from the internet at all. The request forgery bug needs no session, and its whole effect is to tunnel to exactly those localhost-only services that are normally off limits from outside. Used in tandem, the unauthenticated flaw reaches the surface the authenticated flaw needs, and the authenticated flaw turns that reach into command execution. SonicWall confirmed the two were exploited together as zero-days, and Rapid7's managed detection and response team reported observing the in-the-wild exploitation of internet-facing SMA1000 appliances before the public disclosure.

The appliance whose entire job is to stand between the internet and the internal network is the one an attacker most wants to own, because owning it means inheriting that trusted position.

SonicWall was also candid that this is not a SonicWall-only story. A company spokesperson told Help Net Security, "we have confirmed that these vulnerabilities are being actively exploited in the wild and are not unique to SonicWall." We read that as a caution against treating this as one vendor's isolated bug rather than as part of the broader, sustained targeting of edge access appliances.

Why this hits OT and critical infrastructure

SMA 1000 appliances are general-purpose remote access gateways, not industrial gear. They matter for OT and critical infrastructure for the same reason RMM platforms and firewalls do: they are the trusted channel that reaches into a protected environment. Government agencies, multinationals, and managed security service providers are exactly the operators SonicWall names for this product line, and those operators sit in front of water and wastewater utilities, energy operators, manufacturing sites, and healthcare networks.

An edge VPN gateway is a natural bridge point between the enterprise IT network and the operational network behind it. Compromise the gateway and an attacker does not need a separate OT exploit to start reconnaissance against the environment it fronts. The request forgery flaw makes this concrete: it lets an unauthenticated attacker use the appliance itself to tunnel inward, which is precisely the pivot that segmentation is supposed to prevent. This is the same pattern we have written about with Citrix NetScaler, FortiGate, and Cisco SD-WAN. The edge appliance keeps being the front door, and it keeps being the target.

What we see from our sensors

We run a fleet of honeypots and edge decoys, so we went looking for this activity in our own data. We want to be precise about what we found, and what we did not.

We did not capture CVE-2026-15409 or CVE-2026-15410 themselves. Our decoys are generic SSH, Telnet, SMB, HTTP, and a curated set of industrial protocol and edge-appliance emulations. None of them currently impersonate a SonicWall SMA management console or Work Place portal, so an attacker hunting that exact surface would not find it on our sensors.

What we do see, every day, is the perimeter pressure this campaign assumes. SSL VPN login portals, appliance management consoles on non-standard ports, and probes for the request-forgery patterns that these bugs depend on are constant background noise on our HTTP decoys. Requests that try to make a server fetch an attacker-chosen resource, hunt for internal metadata endpoints, or enumerate admin paths are exactly the class of traffic a request-forgery-driven pivot generates, and we log that shape of request routinely. SonicWall's own note that SMA appliances and firewalls are repeatedly targeted, sometimes through fresh zero-days and sometimes through old known bugs, matches what our sensors see at the edge.

What to do this week

Indicators and references