SonicWall SMA1000 zero-days chain a pre-login SSRF into remote code execution, exploited now

The pattern is the story

Look at that table as a trajectory, not a list. In January 2025 the SMA1000 took a standalone deserialization flaw, CVE-2025-23006, that reached CISA's Known Exploited Vulnerabilities catalog. Later in 2025 came a privilege-escalation issue, CVE-2025-40602. Then in July 2026 the shape changed: SonicWall disclosed a pre-login SSRF, CVE-2026-15409, rated a maximum CVSS 10.0, paired with a command-execution flaw, CVE-2026-15410, and the two chained into a fully remote, unauthenticated path to running code. We wrote that chain up at the time. Six weeks later, the September pair repeats it almost beat for beat: pre-login SSRF into command injection, exploited as a zero-day.

Two chains with the same architecture in two months is not bad luck. It says the boundary between the SMA1000's unauthenticated WorkPlace portal and its privileged management console is thin enough that researchers, and attackers, keep finding ways across it. The July SSRF and the September SSRF both come down to the appliance being talked into reaching places it should refuse to reach. When the same class of flaw in the same component produces the same exploit chain twice, the honest conclusion for a defender is that a third is a question of when, and the exposed WorkPlace interface is a standing liability whether or not there is a current CVE against it.

There is a second lesson in the timeline that our earlier coverage made concrete. The July SMA1000 chain did not stay in the hands of quiet espionage operators. Ransomware crews picked those zero-days up and used the appliance foothold to steal multi-factor seeds, which meant resetting passwords did not evict them. Expect the September chain to follow the same path from initial exploitation to commodity ransomware use, and plan the response for that outcome rather than the optimistic one.

Patch, then treat every exposed box as compromised

The fix is the easy half. SonicWall has released a hotfix for the affected SMA1000 firmware, available through mysonicwall.com, and installing it should be tonight's work, not this quarter's. But a confirmed zero-day means the patch closes a door attackers may already be standing behind. SonicWall itself advises re-imaging affected appliances where compromise is suspected, and for an internet-facing SMA1000 that has been reachable during the exploitation window, suspicion is the correct default.

Concretely, for any exposed SMA1000: apply the hotfix, then rotate every secret the appliance touches, including administrator credentials, any service-account passwords it stores, and the multi-factor seeds and session tokens it brokers. Pull the WorkPlace portal off the open internet if your architecture allows it, so the next pre-login flaw in this component has no unauthenticated audience. If the box was internet-facing and you cannot rule out access, re-image it from a known-good build rather than trusting that a patch alone returned it to a clean state.

How would you know you were already hit?

Patching tells you the hole is closed. It does not tell you whether someone walked through it first, and that is the question worth more of your attention. The detection chokepoint here is the pre-login SSRF, because it is the only part of the chain an unauthenticated attacker touches before they have any foothold. On the WorkPlace interface, hunt for requests that use the unintended alternate access path, for outbound connections the appliance made to internal or unexpected hosts, and for portal traffic that resolves to management functionality it should never reach unauthenticated.

On the management side, the command injection runs as the appliance, so watch for unexpected processes, new or modified files, outbound command-and-control connections, and any administrative action you cannot tie to a real change. SonicWall's advisory and CISA's catalog entries for the earlier chains are the reference points for indicators. The specific bytes will differ; the behavior, an unauthenticated portal request that ends in the appliance running a command, is the same signal you were told to watch for in July, and it is the one to have wired into your monitoring before the next SMA1000 advisory lands.