SonicWall SMA1000 flaws exploited as zero-days to push custom malware
Threat actors were able to install custom malware on susceptible VPN appliances for weeks by taking use of two previously revealed SonicWall SMA1000 vulnerabilities in zero-day assaults.
SonicWall issued a warning last week that two previously unreported vulnerabilities in an exploit chain that impacted SMA1000 Secure Mobile Access equipment were being actively exploited by threat actors.
The vulnerabilities impact SMA1000 6210, 7210, and 8200v appliances and are identified as CVE-2026-15409, a critical server-side request forgery (SSRF) vulnerability, and CVE-2026-15410, a high-severity command injection weakness.
SonicWall urged users to install the patches in versions 12.4.3-03453 and 12.5.0-02835 as soon as possible.
SonicWall acknowledged that the vulnerabilities were exp...