Reported by 28 outlets

Timeline

1. original reporting

   SonicWall SMA1000 — Two Zero-Day Flaws Under Active Exploitation, CVSS 10.0, Added to CISA KEV

   bleepingcomputer.com · 91d ago · July 15th, 2026

   SonicWall has confirmed that two vulnerabilities in its SMA1000 secure remote access appliances are being actively exploited as zero-days and has issued an urgent patch advisory. CVE-2026-15409 (CVSS 10.0) is a critical server-side request forgery (SSRF) vulnerability in the SMA1000 Appliance Work Place interface that allows a remote, unauthenticated attacker to force the appliance to make requests to unintended locations. CVE-2026-15410 (CVSS 7.2) is a post-authentication code injection flaw in the Management Console enabling OS command execution as an administrator.

   SonicWall investigated multiple incidents confirming active exploitation. CISA has added both to KEV with a July 17, 2026 federal remediation deadline under BOD 26-04. Affected models: SMA 6210, 7210, and 8200v. No workarounds exist — patching to hotfix versions 12.4.3-03453 or 12.5.0-02835 is the only remediation. SonicWall provides IOCs including anomalous log entries at /__api__/login, /__api__/logout, and /wsproxy endpoints. If compromised, re-image or redeploy appliances, rotate all credentials, and reset TOTP tokens.

   Hunting hypothesis: An unauthenticated attacker sends a crafted SSRF payload to the SMA1000 Work Place interface (/__api__/login or /wsproxy), forcing the appliance to proxy requests to internal infrastructure, then chains with CVE-2026-15410 via a compromised admin session to execute arbitrary OS commands on the appliance — establishing persistent VPN tunnel access into the victim network.

   Action: Patch immediately. Audit SonicWall SMA logs for the published IOCs. These appliances sit at the network perimeter and provide VPN access — compromise grants direct network entry.

   ---

2. update from rapid7.com

   SonicWall SMA1000 Zero-Days — Rapid7 MDR Discovers Active Exploitation, CISA KEV Deadline Tomorrow

   rapid7.com · 90d ago · July 16th, 2026

   Previously covered July 15 (initial disclosure). New: Rapid7 MDR publishes operational findings confirming exploitation; federal remediation deadline July 17.

   Rapid7's Managed Detection and Response team discovered the active exploitation of CVE-2026-15409 (CVSS 10.0, unauthenticated SSRF) and CVE-2026-15410 (CVSS 7.2, post-auth code injection) on customer SMA1000 appliances during routine threat hunting. Tenable's analysis confirms the SSRF component requires no authentication and can force the appliance to proxy requests to internal infrastructure, while the code injection flaw enables OS command execution as an administrator. If compromised, treat the entire network behind the SMA as potentially accessed.

3. update from bleepingcomputer.com

   SonicWall SMA1000 — Volexity Details Full Zero-Day Exploitation Chain

   bleepingcomputer.com · 85d ago · July 21st, 2026

   New: Volexity IR report reveals previously unknown threat actor UTA0533 exploited CVE-2026-15409/CVE-2026-15410 starting June 22 — weeks before disclosure.*

   Volexity's incident response report reveals the full attack chain: threat actor UTA0533 chained the SSRF (CVE-2026-15409, CVSS 10.0) and command injection (CVE-2026-15410, CVSS 7.2) flaws to install custom malware on SMA1000 VPN appliances, enabling persistent access and network proxying. The exploitation began three weeks before SonicWall's public disclosure. Action: If you haven't patched SMA1000 appliances (12.4.3-03453 / 12.5.0-02835), assume compromise. Sources:

4. update from bleepingcomputer.com

   CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs

   bleepingcomputer.com · 64d ago · August 10th, 2026

   CISA has confirmed that ransomware gangs have begun exploiting two recently patched SonicWall SMA1000 vulnerabilities, including a maximum-severity server-side request forgery (SSRF) flaw. ​SMA1000 is an enterprise-grade secure remote access gateway used by large corporations, government agencies, and Managed Service Providers (MSSPs) to provide VPN access to internal applications and corporate networks. SonicWall released patches for the two security flaws (tracked as CVE-2026-15409 and CVE-2026-15410) in mid July, when it also warned that threat actors had been exploiting them in zero-day attacks . "SonicWall PSIRT has investigated multiple cases indicating the active exploitation of the vulnerabilities described in this advisory," the company warned at the time. "Customers are strongly urged to upgrade to the hotfix release as soon as possible to remediate these vulnerabilities." Incident response firm Volexity later revealed that a threat actor tracked as UTA0533 began exploiting the vulnerabilities as early as June 22 (weeks before SonicWall publicly disclosed the flaws) to deploy custom malware known as KNUCKLEBALL, Sou5, ROOTRUN, and ORANGETAIL on vulnerable VPN appliances. Internet security watchdog Shadowserver currently tracks over 380 SMA1000 appliances exposed online, although some may already have been secured against attacks. Cybersecurity and Infrastructure Security Agency (CISA)

5. update from bleepingcomputer.com

   SonicWall SMA1000 Zero-Days Now Confirmed in Ransomware-Campaign Use

   bleepingcomputer.com · 64d ago · August 11th, 2026

   The SSRF turns an internet-facing VPN gateway into a proxy for internal services; chained, the pair escalates from unauthenticated internet access to root-level appliance compromise. PSIRT observed pre-disclosure exploitation beginning June 22 by a cluster tracked as UTA0533, and subsequent reporting links substantial activity to the INC ransomware operation.

6. update from cyberpress.org

   CISA Warns of Actively Exploited Critical SonicWall SMA1000 SSRF Flaw in Zero-Day Attacks

   cyberpress.org · 63d ago · August 11th, 2026

   Classified as CWE-918, the issue enables a remote, unauthenticated attacker to coerce a vulnerable appliance into making requests to unintended locations. Critical SonicWall SMA1000 SSRF Flaw Exploited In practice, the vulnerability can turn an internet-facing VPN gateway into a proxy for reaching backend services that should be restricted to localhost or trusted internal connections.

7. update from gbhackers.com

   CISA Warns SonicWall SMA1000 Flaws Are Exploited in Ransomware Attacks

   gbhackers.com · 63d ago · August 11th, 2026

   It has […] The post CISA Warns SonicWall SMA1000 Flaws Are Exploited in Ransomware Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

8. update from securityweek.com

   SonicWall Warns of Two SMA1000 Zero-Days Exploited in Attacks

   securityweek.com · 41d ago · September 2nd, 2026

   According to an advisory published by SonicWall on Tuesday, the vulnerabilities and their exploitation were discovered internally. An attacker can exploit it remotely without authentication to access sensitive functionality and conduct unauthorized operations. Hotfixes 12.4.3-03526, 12.5.0-02952, and higher versions patch the vulnerabilities. SSL-VPN on SonicWall firewalls and SMA100 series products are not affected. No details appear to be available on the attacks exploiting CVE-2026-83548 and CVE-2026-83549, and the vendor’s public advisory does not include indicators of compromise (Io

9. update from bleepingcomputer.com

   SonicWall warns of actively exploited SMA1000 zero-day flaws

   bleepingcomputer.com · 41d ago · September 2nd, 2026

   The two security flaws affect SMA1000 6210, 7210, and 8200v models, but they don't affect SSL-VPN running on SonicWall firewalls or the SMA 100 Series product line. While the company also advised admins to re-image appliances, change all user and administrator passwords, and reset TOTP t

10. update from cyberpress.org

    Hackers Exploit Critical SonicWall SMA 1000 SSRF and RCE Flaws in Active Attacks

    cyberpress.org · 41d ago · September 2nd, 2026

    The flaw stems from an unintended alternate access path that can effectively operate as an unauthorized forward proxy. SonicWall assigned the flaw a CVSS v3 score of 10.0, reflecting network-based exploitation with no authentication or user interaction required. SSRF vulnerabilities are especially dangerous in internet-facing security appliances because they may allow attackers to make request

11. mentioned by gbhackers.com

    Critical SonicWall SMA 1000 Vulnerabilities Actively Exploited in the Wild

    gbhackers.com · 41d ago · September 2nd, 2026

12. update from malware.news

    SonicWall security advisory (AV26-872)

    malware.news · 41d ago · September 2nd, 2026

    The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Security Advisory SonicWall Security Advisories Article Link: SonicWall security advisory (AV26-872) - Canadian Centre for Cyber Security

13. update from rapid7.com

    Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild

    rapid7.com · 41d ago · September 2nd, 2026

    On its own, exploitation requires an authenticated administrator and specific system conditions. Their role as network-edge systems makes successful exploitation particularly concerning, since affected Work Place interfaces may be exposed directly to the internet as part of normal deployment.

14. update from cyberpress.org

    CISA Warns Hackers Are Exploiting SonicWall SMA1000 SSRF and RCE Flaws

    cyberpress.org · 40d ago · September 3rd, 2026

    CISA added both vulnerabilities on September 2, 2026, and set a remediation deadline of September 5, 2026, for federal civilian executive branch agencies. The short turnaround highlights the agency’s assessment that exposed SMA1000 deployments require urgent attention. The vulnerability is associated with CWE-918, which covers SSRF weaknesses, and CWE-441, an improper enforcement of behavioral workflow issue. This can potentially bypass network-based access controls that would ordinarily prevent external systems from reaching internal services or administrative functions. Organizations should determine whether their SMA1000 applia

15. mentioned by gbhackers.com

    CISA Warns SonicWall SMA1000 Flaws Are Actively Exploited in Attacks

    gbhackers.com · 40d ago · September 3rd, 2026

16. update from malware.news

    SonicWall Vulnerabilities Exploited in the Wild

    malware.news · 40d ago · September 3rd, 2026

    Recommended Actions Truesec recommends upgrading affected SonicWall appliances to the patched versions: 12.4.3-03526 platform-hotfix, for systems on the 12.4.3 branch 12.5.0-02952 platform-hotfix, for systems on the 12.5.0 branch If evidence of compromise is identified we recommend: Re-

17. update from socprime.com

    CVE-2026-83548 and CVE-2026-83549: SonicWall SMA 1000 Zero-Days Exploited in the Wild

    socprime.com · 40d ago · September 3rd, 2026

    SonicWall says it investigated a case showing active exploitation of both issues, while SecurityWeek and The Hacker News note that the activity suggests attackers may be chaining the pre-authentication weakness with the command injection flaw to execute code on vulnerable SMA 1000 devices.

18. update from cyberscoop.com

    Attackers exploit zero-days in consistently besieged SonicWall product

    cyberscoop.com · 40d ago · September 3rd, 2026

    SonicWall customers are grappling with yet another pair of actively exploited zero-day vulnerabilities in SonicWall SMA 1000 appliances, a product that’s been besieged with recurring defects and attacks over the past nine months. Attackers have consistently exploited newly discovered zero-days and years-old defects in the vendor’s products to break into victim environments. SonicWall did not say how many customers have been directly impacted by active exploitation or when the first known instance of exploitation occurred. “Please stop us if you’ve heard this one before: Another appliance sitting at the edge of the network, another pair of vulnerabilities chained together, and another unauthenticated path to complete compromise,” Jake Knott, head o

19. mentioned by www.defensorum.com

    🔧 Running a # SonicWall SMA1000 6210, 7210 or 8200v? 🚨 Two zero-days are being actively exploited 🔓 Attackers can chain CVE-2026-83548 and C

    www.defensorum.com · 32d ago · September 11th, 2026

20. update from cyberworldops.eu

    Borough Council of King's Lynn and West Norfolk incident linked with moderate confidence to mass exploitation of CVE-2026-15409 in SonicWall

    cyberworldops.eu · 32d ago · September 11th, 2026

    Borough Council of King's Lynn and West Norfolk incident linked with moderate confidence to mass exploitation of CVE-2026-15409 in SonicWall

    via Mastodon https://cyberworldops.eu/en/uk-council-cyberattack-tied-to-mass-exploitation-of-critical-sonicwall

21. mentioned by psirt.global.sonicwall.com

    new SonicWall SMA1000 advisory. Check out CVE-2026-102255 ( 10.0 critical ) Pre-authentication SSRF via unintended forward-proxy. No mention

    psirt.global.sonicwall.com · 7d ago · October 6th, 2026

22. update from bleepingcomputer.com

    SonicWall warns of max severity SSRF flaw in SMA1000 gateways

    bleepingcomputer.com · 6d ago · October 7th, 2026

    Although CVE-2026-102255 is not exploited in the wild, attackers often target SMA100

23. update from ifin.network

    Chat, is it bad if your zero-trust VPN device forwards network requests without auth? Asking for thousands of friends. SonicWall SMA1000 dev

    ifin.network · 6d ago · October 7th, 2026

    Chat, is it bad if your zero-trust VPN device forwards network requests without auth? Asking for thousands of friends.

24. mentioned by malware.news

    SonicWall security advisory (AV26-1017)

    malware.news · 6d ago · October 7th, 2026

25. mentioned by censys.com

    🚨 Rapid Response: SonicWall has patched a critical CVSS 10.0 pre-authentication SSRF in SMA1000 appliances (CVE-2026-102255). Censys detects

    censys.com · 6d ago · October 7th, 2026

26. mentioned by thehackernews.com

    🤖 SonicWall SMA1000 hotfixes: critical pre-auth SSRF (CVE-2026-102255, CVSS 10.0) in the WorkPlace portal lets unauthenticated attackers rea

    thehackernews.com · 6d ago · October 7th, 2026

27. mentioned by thehackernews.com

    🤖 SonicWall patched CVE-2026-102255, a CVSS 10.0 pre-auth SSRF in SMA1000's WorkPlace portal: an unauthenticated attacker can reach internal

    thehackernews.com · 5d ago · October 8th, 2026

28. update from malware.news

    Critical SonicWall SMA1000 Pre-Authentication SSRF Vulnerability

    malware.news · 5d ago · October 8th, 2026

    CVE-2026-102257 is a Zip Slip path traversal vulnerability within the Appliance Management Console. An authenticated attacker could exploit the flaw using a specially crafted archive to extract files outside the intended directory, potentially leading to remote code execution. CVE-2026-102258 is a stored cross-site scripting (XSS) vulnerability that could allow a remote authenticated administrator to store and execute arbitrary JavaScript in the Appliance Management Console.

29. update from securityweek.com

    SonicWall and Splunk Patch Critical Vulnerabilities

    securityweek.com · 5d ago · October 8th, 2026

    SonicWall rolled out fixes for four vulnerabilities in its SMA1000 appliances, urging users to update to versions 12.5.0-03082 and 12.4.3-03670 as soon as possible. Splunk announced fixes for dozens of security flaws in Splunk Enterprise, MCP Server, and Add-on for Amazon Web Services. MCP Serv

30. mentioned by beyondmachines.net

    SonicWall Patches Critical Pre-Auth SSRF in SMA 1000 Series Appliances SonicWall patched four vulnerabilities in its SMA 1000 series applian

    beyondmachines.net · 5d ago · October 8th, 2026

31. update from securityonline.info

    Attackers target a critical SonicWall SMA1000 vulnerability in the wild. Apply vendor hotfixes to secure remote access gateways against CVE-

    securityonline.info · 4d ago · October 9th, 2026

    Apply vendor hotfixes to secure remote access gateways against CVE-

    via Mastodon https://securityonline.info/sonicwall-sma1000-vulnerability-exploited/?utm_source=mastodon&utm_medium=jetpack_social

32. update from bleepingcomputer.com

    Max severity SonicWall SMA1000 flaw now exploited in attacks

    bleepingcomputer.com · 4d ago · October 9th, 2026

    While SonicWall has not yet flagged this vulnerability as actively exploited in its Tuesday advisory, Previdian founder and security researcher Ryan Dewhurst told BleepingComputer on Friday that the company's honeypot network has detected exploitation attempts consistent with the CVE-2026-102255 flaw. "The requests targeted the WorkPlace Extraweb interface, using a crafted OPTIONS request to reach the appliance's internal CouchDB service at 127.0.0.1:5984. The payload attempted to traverse into a CouchDB design document and invoke its _rewrite function, while supplying an HTTP Basic Authorization header containing the credentials admin:admin," Dewhurst told BleepingComputer. However, the October vulnerability uses a different exploitation technique

33. update from www.bleepingcomputer.com

    Max severity SonicWall SMA1000 flaw now exploited in attacks Source: BleepingComputer Read: https://www. bleepingcomputer.com/news/secu rity

    www.bleepingcomputer.com · 4d ago · October 9th, 2026

    Max severity SonicWall SMA1000 flaw now exploited in attacks Source: BleepingComputer Read: https://www.

34. mentioned by www.bleepingcomputer.com

    🤖 CVE-2026-102255 (max severity): unauthenticated SSRF in SonicWall SMA1000 Appliance WorkPlace (6210/7210/8200v). Crafted OPTIONS requests

    www.bleepingcomputer.com · 4d ago · October 9th, 2026

35. mentioned by fawkes.rocks

    SonicWall SMA1000 max-severity flaw now exploited https:// fawkes.rocks/2026/10/10/sonicw all-sma1000-max-severity-flaw-now-exploited/

    fawkes.rocks · 3d ago · October 10th, 2026

36. mentioned by www.bleepingcomputer.com

    Max severity # SonicWall # SMA1000 flaw now exploited in attacks https://www. bleepingcomputer.com/news/secu rity/max-severity-sonicwall-sma

    www.bleepingcomputer.com · 3d ago · October 10th, 2026

37. update from ninjalabz.io

    🗞 Probably Fine Daily No. 14 SonicWall patched on Tuesday. It was being exploited by Friday. Today's threat brief, read by AI — with receipt

    ninjalabz.io · 2d ago · October 11th, 2026

    🗞 Probably Fine Daily No. It was being exploited by Friday. Today's threat brief, read by AI — with receipt

    via Mastodon https://ninjalabz.io/daily/2026-10-11/

38. mentioned by cyberunit.com

    (cyberunit.com) Critical SonicWall SMA1000 SSRF Flaw (CVE-2026-102255) Exploited in the Wild: What Businesses Need to Know In brief - This a

    cyberunit.com · 2d ago · October 11th, 2026

39. update from www.itnews.com.au

    A critical security flaw has been discovered in certain network software, even after recent updates. If your business uses these systems, pl

    www.itnews.com.au · 2d ago · October 11th, 2026

    A critical security flaw has been discovered in certain network software, even after recent updates. If your business uses these systems, pl

    via Mastodon https://www.itnews.com.au/news/netscaler-builds-that-fixed-zero-days-carry-critical-flaw-too-629542

40. mentioned by insomnisec.com

    Attackers Are Already Probing SonicWall SMA1000's Third Maximum-Severity Flaw of 2026 If your employees, contractors, or managed service pro

    insomnisec.com · 2d ago · October 11th, 2026

41. update from socfortress.medium.com

    SonicWall SMA1000 Flaw Exploitation and Security Advisory

    socfortress.medium.com · 2d ago · October 11th, 2026

    Although initial vendor documentation lacked evidence of exploitation, independent honeypot networks quickly detected active cyberattacks targeting the WorkPlace interface. Alongside this critical issue, the security advisory outlines several other vulnerabilities requiring immediate software upgrades and hotfixes to protect enterprise networks. Vulnerability Overview & Operational Context Enterprise-grade remote access infrastructure represents a foundational pillar of modern perimeter defense, making secure remote access gateways primary targets for advanced threat actors. Devices such as the SonicWall SMA1000 series serve as critical network access points, providing centralized Virtual Private Network (VPN) connectivity to internal applications and enterprise networks across Managed Security Service Providers (MSSPs), commercial enterprises, and government agencies.

42. update from suriq.io

    SonicWall patched a max-severity flaw in its SMA1000 VPN gateways on Oct 6. Honeypots saw exploitation a day later. CVE-2026-102255 is a CVS

    suriq.io · 1d ago · October 12th, 2026

    Honeypots saw exploitation a day later. CVE-2026-102255 is a CVS

    via Mastodon https://suriq.io/blog/sonicwall-sma1000-cve-2026-102255-preauth-ssrf

43. update from securityweek.com

    Critical SonicWall Vulnerability Exploited Days After Disclosure

    securityweek.com · 1d ago · October 12th, 2026

    On Friday, threat intelligence firms Previdian (formerly KEVIntel) and Defused warned of the first exploitation attempts targeting the security bug. Related: Unpatched AhsayCBS Vulnerabilities Exploited in the Wild Related: Citrix Urges Immediate Patching o

44. mentioned by thehackernews.com

    🤖 CVE-2026-102255 (CVSS 10.0): pre-auth SSRF in SonicWall SMA 1000 appliances, patched Oct 6 (12.4.3-03670 / 12.5.0-03082). 135 exploitation

    thehackernews.com · 1d ago · October 12th, 2026

45. mentioned by threatnoir.com

    ⚠️ CRITICAL: Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch SonicWall SMA 1000 appliances are being acti

    threatnoir.com · 1d ago · October 12th, 2026

46. mentioned by cyberupdates365.com

    Critical SonicWall SMA 1000 Flaw Targeted in Exploitation Attempts Attackers are targeting CVE-2026-102255, a critical pre-authentication SS

    cyberupdates365.com · 1d ago · October 12th, 2026

47. mentioned by tp-security.com

    Monday brief: - SonicWall SMA1000 CVE-2026-102255 (CVSS 10.0) pre-auth SSRF: exploit attempts since Oct 8. Fix: 12.4.3-03670 / 12.5.0-03082

    tp-security.com · 1d ago · October 12th, 2026

48. mentioned by www.bleepingcomputer.com

    [Part 2] Fix: 12.4.3-03670 and 12.5.0-03082, models 6210, 7210 and 8200v (SMA 100 and firewall SSL-VPN not affected). Patterns to search in logs

    www.bleepingcomputer.com · 1d ago · October 12th, 2026

49. mentioned by www.darkreading.com

    🤖 CVE-2026-102255 (CVSS 10.0): pre-auth SSRF in SonicWall SMA 1000's WorkPlace interface via an unintended alternate access path. Honeypots

    www.darkreading.com · 1d ago · October 12th, 2026

50. mentioned by www.darkreading.com

    🎧 Cybersecurity / Cybersecurity / Security / News / Technology. A maximum-severity SSRF flaw in SonicWall SMA devices is under active attack. Reported via darkreading.com.

    www.darkreading.com · 1d ago · October 13th, 2026

51. mentioned by www.darkreading.com

    Hackers are actively targeting a serious security flaw in certain SonicWall remote access devices. If your business uses these tools, please

    www.darkreading.com · 1d ago · October 13th, 2026

52. mentioned by nvd.nist.gov

    🤖 CVE-2026-102255 (CVSS 10.0): pre-auth SSRF in the SonicWall SMA 1000 Appliance Work Place interface, via an unintended alternate access pa

    nvd.nist.gov · 19h ago · October 13th, 2026

53. mentioned by gbhackers.com

    SonicWall Fixes 4 SMA 1000 Vulnerabilities, Including Critical CVSS 10.0 SSRF Flaw

    gbhackers.com · 18h ago · October 13th, 2026

54. mentioned by www.darkreading.com

    🗞 Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack via Dark Reading https://www. darkreading.com/vulnerabilitie s-threats/ma

    www.darkreading.com · 17h ago · October 13th, 2026

55. mentioned by beyondmachines.net

    SonicWall SMA 1000 Appliances Face Active Exploitation of Critical SSRF Flaw SonicWall SMA 1000 appliances are under active attack following

    beyondmachines.net · 17h ago · October 13th, 2026

56. mentioned by tp-security.com

    Cyber Brief, Oct 13: - SonicWall SMA 1000 CVE-2026-102255 (SSRF, CVSS 10.0): exploitation attempts since Oct 8. Fixed: 12.4.3-03670 / 12.5.0

    tp-security.com · 14h ago · October 13th, 2026