SonicWall Issues Emergency Hotfixes After Detecting Active Exploitation of Two Zero-Day Vulnerabilities in SMA1000 Appliances
SonicWall has confirmed the active exploitation of two zero-day vulnerabilities in its SMA1000 series appliances, triggering an emergency response and the rapid release of hotfixes. The company detected real-world intrusions targeting these perimeter devices, which provide remote access to corporate networks, significantly elevating risk for any organization with internet-exposed units.
The first vulnerability, CVE-2026-15409, received a maximum CVSS 10.0 score and involves unauthenticated server-side request forgery (SSRF) in the SMA1000 Appliance Work Place interface. This flaw allows remote attackers to compel the appliance to send requests to unintended internal destinations, serving as a common foothold for pivoting deeper into corporate environments.
The second issue, CVE-2026-15410, carries a CVSS 7.2 rating and affects the SMA1000 Appliance Management Console. It enables authenticated code injection, permitting an administrator to execute operating system commands. In sophisticated attacks, this type of vulnerability is frequently used to establish persistence, alter configurations, or maintain long-term access.
Affected Products and Available Fixes
Impacted models include SMA6210, SMA7210, and SMA8200v. Vulnerable platform versions encompass 12.4.3-03245, 12.4.3-03387, 12.4.3-03434, 12.5.0-02283, 12.5.0-02624, and 12.5.0-02800. SonicWall has released corrected hotfixes 12.4.3-03453 and 12.5.0-02835, along with subsequent updates. No alternative mitigations are considered sufficient; organizations must apply these patches.
Exploitation and Regulatory Response
Attacks observed in the wild may chain both vulnerabilities, although confirmation varies across sources. CISA has added both CVEs to its Known Exploited Vulnerabilities catalog, mandating that U.S. federal agencies apply fixes or decommission affected systems by July 17, 2026. The vulnerabilities do not impact SonicWall SSL VPN firewalls or the SMA 100 Series appliances.
Indicators of Compromise and Recommended Actions
Key indicators of compromise include HTTP 200 responses for /api/login or /api/logout requests in extraweb_access.log, suspicious /wsproxy calls returning HTTP 101, evidence of unauthorized hotfix rollbacks in ctrl-service.log, and anomalous paths in /var/lib/unit/conf.json.
- Immediately update exposed SMA1000 appliances to versions 12.4.3-03453 or 12.5.0-02835.
- Inventory all SMA6210, SMA7210, and SMA8200v devices and prioritize those with administrative exposure.
- Review logs for listed IOCs and preserve evidence for forensic analysis if compromise is suspected.
- Reimage physical appliances or redeploy virtual instances before returning them to production.
- Rotate all user and administrator passwords, reset TOTP tokens, and restrict administrative access to management networks or bastions.
- Implement monitoring for anomalous /wsproxy host parameters and /api/login or /api/logout activity.
Additional details are available from BleepingComputer, Help Net Security, and The Hacker News.
Related articles
Cisco ISE Affected by 42 Vulnerabilities Including Multiple Critical Flaws with Confirmed Exploitation
Cisco Identity Services Engine (ISE) has been found to contain 42 vulnerabilities across 15 security advisories released by Cisco Systems on September 16, 2026. Six advisories received the highest Critical rating, covering 21 individual vulnerabilities, while three were rated High and six Medium. One standout issue, CVE-2026-76460, allows attackers to bypass authentication on the management API via crafted HTTP requests and execute commands with root privileges. The flaw also impacts the Cisco ISE Passive Identity Connector (ISE-PIC). Cisco has urged immediate application of updates as some vulnerabilities are already being exploited in the wild. The product provides core network authentication and access control functions for enterprise environments.
CISA Adds Three Actively Exploited Vulnerabilities to KEV Catalog, Including Cisco ISE and Acronis Backup Flaws
The US Cybersecurity and Infrastructure Security Agency has added three vulnerabilities with confirmed in-the-wild exploitation to its Known Exploited Vulnerabilities catalog. The flaws affect Cisco Identity Services Engine, its Passive Identity Connector, and Acronis Backup plugins for cPanel and Plesk. All three entries carry a remediation deadline of September 19, 2026. The Cisco issue stems from insufficient authentication controls on an API endpoint that lets remote attackers bypass the web-based management interface. The Acronis vulnerability arises from overly permissive default settings in server-management plugins, enabling privilege escalation. Federal agencies have been directed to investigate potential compromises and apply mitigations without delay.
R-Vision VM 6.6 Adds Container Scanning, Web Application Audits and Mobile Scanner for Isolated Networks
R-Vision has released version 6.6 of its vulnerability management platform, expanding detection capabilities to web applications, Docker and Kubernetes container environments, and previously unreachable isolated network segments. The new web audit feature inventories resources and identifies associated vulnerabilities, although the company describes the current functionality as basic and not intended to replace dedicated DAST solutions. Container auditing now covers both Docker and Kubernetes, including runtime analysis, with findings presented directly in the host card within the central console. The most notable addition is a mobile scanner that runs on a laptop without requiring dedicated servers, allowing security specialists to audit air-gapped or remote sites and later upload results to the main R-Vision VM instance. The mobile component supports White Box, Black Box, Compliance and web-audit modes, performs full inventory, and is designed to scan up to 2000 hosts. Additional improvements include expanded inventory for ESXi, vCenter and network equipment, updated compliance checks, enhanced dashboards, automation policies and data export options, plus the ability to update agents directly from the interface.
BloodHound, smbmap and enum4linux-ng: Essential Tools for Starting Active Directory Penetration Testing
Active Directory remains the primary target in most internal penetration tests, regardless of how an attacker first gains network access. The article outlines a practical reconnaissance workflow that begins with identifying the domain name and domain controllers through port scanning for ports 88 and 389. Tools such as enum4linux-ng enable initial data collection without credentials by leveraging null sessions, while smbmap reveals readable and writable SMB shares that often contain SSH keys, certificates, and plaintext passwords. BloodHound, paired with collectors like SharpHound, maps relationships between users, groups, and computers to reveal attack paths toward Domain Admins. The piece stresses understanding Kerberos and NTLM protocols to apply techniques such as Kerberoasting, AS-REP Roasting, and pass-the-hash effectively rather than running commands blindly. It also covers quieter alternatives to noisy tools and provides a concise checklist for beginners, along with references to the Red September CyberED course on Active Directory attacks.