SonicWall SMA1000 Zero-Days Actively Exploited for Lateral Movement

In July 2026, a critical vulnerability chain affecting SonicWall SMA1000 Series appliances was identified under active exploitation as a zero-day. The attack sequence leverages an unauthenticated server-side request forgery (SSRF) in the WebSocket proxy (CVE-2026-15409) to reach local management services, followed by a path traversal flaw in the hotfix-removal workflow (CVE-2026-15410) to achieve root-level code execution. CISA has added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog with immediate remediation deadlines.

Technical analysis confirms that attackers are using these compromised appliances as stealthy initial access vectors. Once root access is established, actors extract high-value credentials, session databases, and TOTP multi-factor authentication seeds. This enables persistent access and direct lateral movement into internal Active Directory environments. Because the appliance is often a trusted network node, this activity may bypass traditional internal security monitoring.

Organizations must prioritize patching affected SMA 6210, 7210, and 8200v models immediately. Due to confirmed exploitation, incident response teams should treat affected systems as potentially compromised, performing deep forensic reviews for configuration tampering and unauthorized lateral movement originating from the appliance's internal IP address.