CVE Tools
Track your stack

SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410)

Help Net SecurityBy Zeljka Zorz

Reported exploitedSecure Mobile Access (SMA) 1000 Series appliances

Our summary

SonicWall has addressed two actively exploited vulnerabilities (CVE-2026-15409, CVE-2026-15410) impacting its Secure Mobile Access (SMA) 1000 Series appliances. These flaws were being used together in real-world attacks, allowing unauthenticated attackers to trigger SSRF and authenticated users to execute arbitrary code. Customers are advised to apply the latest firmware updates and check for signs of compromise. SonicWall also recommends additional post-patch actions like password resets and TOTP token regeneration.

Read at Help Net Security

Help Net Security publishes this story on its own site; we link to it rather than reprint it.

  1. Help Net SecuritySonicWall SMA 1000 appliances under attack via zero-day flawsCVE-2025-40602, CVE-2026-15409 +1
  2. BleepingComputerSonicWall warns of actively exploited SMA1000 zero-day flawsCVE-2025-40602, CVE-2026-15409 +1
  3. BleepingComputerCISA: SonicWall SMA1000 flaws now exploited by ransomware gangsCVE-2025-40602, CVE-2026-15409 +1
  4. Dark ReadingSonicWall SMA 1000 Zero-Days Enable Unauthenticated RCECVE-2026-15409, CVE-2026-15410
  5. The Hacker NewsAttackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack ChainCVE-2026-15409, CVE-2026-15410
  6. The Hacker NewsINC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 FlawsCVE-2026-15409, CVE-2026-15410
  7. SecurityWeekRecent SonicWall Vulnerabilities Exploited in Ransomware AttacksCVE-2026-15409, CVE-2026-15410
  8. Help Net SecurityWeek in review: ServiceNow pre-auth RCE exploited in the wild, Hugging Face breachedCVE-2026-15409, CVE-2026-15410
  9. BleepingComputerNew InfraTrust report reveals infrastructure flaws admins should patch firstCVE-2026-15409, CVE-2026-15410
  10. Help Net SecuritySonicWall SMA zero-days were exploited weeks before disclosureCVE-2026-15409, CVE-2026-15410

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store