SonicWall Discloses Two Zero-Day Vulnerabilities (CVE-2026-15409, CVE-2026-15410)

THE THREAT

On July 14th, 2026, SonicWall disclosed two zero-day vulnerabilities impacting its Secure Mobile Access (SMA) 1000 series firewalls. The first vulnerability is CVE-2026-15409 (CVSS: 10), a Server-Side Request Forgery vulnerability in the SMA1000 Appliance Work Place interface that can allow an unauthenticated remote attacker to cause the appliance to make requests to unintended locations. The second is CVE-2026-15410 (CVSS: 7.2), a post-authenticated code injection flaw within SMA1000 Appliance Management Console (AMC) that could enable a remote authenticated attacker to execute arbitrary OS commands.

SonicWall has confirmed that patches have been released to address the flaws. SonicWall stated that they are aware of "multiple cases" indicating active exploitation of the vulnerabilities, suggesting that they may have been chained together within attacks. Due to reports of ongoing exploitation, organizations should ensure that relevant patches are applied as soon as possible.

What we're doing about it

• eSentire’s Threat Response Unit (TRU) has created new MDR for Network detections to identify exploitation attempts targeting CVE-2026-15409 and CVE-2026-15410
• eSentire Managed Vulnerability Service (MVS) will add the relevant plugins as they become available
• eSentire customers can employ the Vulnerabilities and Inferred Vulnerabilities pages in Atlas Portal to search for potentially vulnerable assets
• eSentire's Threat Response Unit (TRU) is tracking this topic for additional information and detection opportunities

What you should do about it

• After performing a business impact review, apply the relevant security patches
• Review logs outlined by SonicWall for signs of compromise
  • extrawebaccess.log mention requests to /__api__/login or /__api__/logout with HTTP 200 status
  • extraweb_access.log mention requests to /wsproxy with suspicious host parameters with 101 HTTP status
  • ctrl-service.log mention hotfix rollbacks with path traversal names
  • /var/lib/unit/conf.json cotnains routes for /__api__/login or /__api__/logout (these URIs do not exist in legitimate configuration)
• If Indicators are found on the system:
  • Reimage hardware or redeploy virtual appliances
  • Change user and administrator passwords
  • Reset Time-Based One-Time Passwords (TOTP) tokens

Additional information

Although SonicWall stated that exploitation of the vulnerabilities has been identified, no details were provided on the nature of the attacks. The information provided within the advisory suggests that the flaws could potentially be chained together, providing an unauthenticated attacker with access to impacted devices, enabling Remote Code Execution (RCE), but this is not confirmed. SonicWall credited the cybersecurity firm Volexity with assisting in the investigation; at the time of writing, Volexity has not provided any additional information, but may publish a report containing further information in the future.

Currently, technical details on the flaws are also limited, and there are no reports of publicly available Proof-of-Concept (PoC) exploit code. The release of PoC exploit code has been known to signal potential widespread exploitation of a flaw, as it significantly lowers the bar for threat actors to operationalize within attacks. Organizations that utilize SonicWall SMA1000 series firewalls within their environment should ensure that patches are applied as soon as possible. Organizations should also perform a review of the logs outlined by SonicWall within their advisory and look for any signs of possible exploitation. If found, impacted firewalls should be reimaged or redeployed, and credentials should be revoked.

Both vulnerabilities were added to CISA's Known Exploited Vulnerabilities (KEV) catalog on July 14th, and a deadline of July 17th was given for Federal Civilian Executive Branch (FCEB) agencies to apply patches.

References:
[1] https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-15409
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-15410
[4] https://nucleussec.com/blog/public-poc-exploits-clear-signal-defensive-action/
[5] https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-adds-four-known-exploited-vulnerabilities-catalog