Two critical SonicWall SMA 1000 vulnerabilities (CVE-2026-15409, CVSS 10.0, and CVE-2026-15410, CVSS 7.2) were exploited as zero-days to install custom malware for persistent, stealthy access to VPN appliances. Affected versions include SMA 6210 firmware versions 12.4.3-03245 through 12.4.3-03434 and 12.5.0-02283 through 12.5.0-02624. The article does not specify patched versions or workarounds.
Two recently disclosed SonicWall SMA 1000 vulnerabilities – CVE-2026-15409 and CVE-2026-15410 – were exploited in zero-day attacks for weeks, allowing threat actors to install custom malware on vulnerable VPN appliances, Volexity researchers revealed. The intrusions began as early as June 22, 2026, well before the flaws became public. According to the researchers, the attackers’ goal was stealthy, long-term access: once inside, the intruders could reach stored or cached credentials, capture network traffic, and potentially intercept … More → The post SonicWall SMA zero-days were exploited weeks before disclosure appeared first on Help Net Security .