Loading story…
SonicWall disclosed four vulnerabilities in Secure Mobile Access (SMA) 1000 series appliances that could allow SQL injection-based privilege escalation, unauthenticated user credential enumeration, and multi-factor authentication bypass. The issues affect SMA 1000 deployments through flaws in SQL handling and Unicode processing, with the most severe bug tracked as CVE-2026-4112 and rated CVSS 7.2. SonicWall said the vulnerabilities do not impact SSL-VPN functionality on standard SonicWall firewalls.
According to SonicWall's advisory SNWLID-2026-0003, the Unicode-related flaws can bypass TOTP protections in AMC, Workplace, or Connect Tunnel authentication flows, increasing the risk of unauthorized access. SonicWall said it has no evidence of active exploitation and provided hotfixes and fixed releases for affected SMA 1000 versions, adding that no workarounds or alternative mitigations are available, making patching the required response for exposed systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Alongside the advisory, SonicWall instructed administrators to install hotfixes and upgrade affected SMA1000 versions to remediated releases because no workarounds or mitigations were available. The highest-rated issue identified in reporting was CVE-2026-4112 with a CVSS v3 score of 7.2.
SonicWall disclosed four vulnerabilities affecting Secure Mobile Access (SMA) 1000 series appliances, including SQL injection-based privilege escalation, unauthenticated credential enumeration, and Unicode handling flaws that can enable MFA/TOTP bypass. The advisory said there was no evidence of active exploitation and clarified that standard SonicWall firewall SSL-VPN features are not affected.
A critical vulnerability affecting SonicWall SMA1000 Appliance Management Console and Central Management Console was disclosed for version 12.4.3-02804 and earlier. The flaw could be exploited remotely without authentication to execute arbitrary commands, and SonicWall indicated exploitation may already have been observed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcepsirt.global.sonicwall.com
Open sourcekyberturvallisuuskeskus.fi
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SonicWall has released urgent patches for a local privilege escalation vulnerability (CVE-2025-40602) in its Secure Mobile Access (SMA) 1000 appliances, following reports of active exploitation in the wild. Attackers have been chaining this flaw with a previously patched deserialization vulnerability (CVE-2025-23006) to achieve unauthenticated remote code execution with root privileges on affected devices. The vulnerabilities impact the Appliance Management Console (AMC) and Central Management Console (CMC), and SonicWall has advised customers to upgrade to the latest hotfix versions and restrict management interface access to mitigate risk. Security advisories from multiple sources, including government agencies and SonicWall itself, emphasize the criticality of patching due to the widespread use of SMA1000 appliances in large enterprises and critical infrastructure. Over 950 internet-exposed SMA1000 devices have been identified, heightening concerns about potential exploitation. No indicators of compromise have been released, but organizations are urged to apply the fixes immediately and review their exposure to the AMC and SSH interfaces to prevent further attacks.
Jul 23, 2026
SonicWall has patched two vulnerabilities that are being actively exploited against **SMA 1000 Series** appliances, affecting models including **6210, 7210, and 8200v**. The flaws, tracked as **`CVE-2026-15409`** and **`CVE-2026-15410`**, impact multiple **12.4.3** and **12.5.0** platform-hotfix releases. SonicWall described `CVE-2026-15409` as a **critical unauthenticated SSRF** issue in the Appliance Work Place interface and `CVE-2026-15410` as a **high-severity code injection** flaw in the Appliance Management Console that can allow an authenticated administrator to execute arbitrary operating system commands. SonicWall said the vulnerabilities have been exploited together in the wild and released hotfixes to address them. Government and vendor advisories urged organizations to update immediately and investigate appliances for signs of compromise, warning that patching alone may not be sufficient if an appliance has already been breached. SonicWall recommended reviewing logs, re-imaging or re-deploying affected systems where indicators are found, changing user and administrator passwords, and resetting TOTP tokens. The **Canadian Centre for Cyber Security** highlighted the advisory, and **CISA** added both vulnerabilities to its **Known Exploited Vulnerabilities** catalog the same day, underscoring the urgency for defenders to remediate exposed SMA1000 deployments.
Jul 24, 2026
SonicWall disclosed multiple vulnerabilities in **SonicOS** affecting Generation 6, 7, and 8 hardware and virtual firewall products, including flaws that could let attackers bypass access controls, reach restricted services, or trigger denial of service by crashing firewalls. The issues, identified by CrowdStrike’s Advanced Research Team and tracked as `CVE-2026-0204`, `CVE-2026-0205`, and `CVE-2026-0206`, carry CVSS scores of **8.0**, **6.8**, and **4.9** respectively, and were also reflected in advisory **dCERT 2026-1294**. SonicWall released fixed firmware versions and urged administrators to apply updates immediately. Where patching cannot be completed at once, the company advised disabling **HTTP/HTTPS management** and **SSLVPN** on all interfaces and restricting management access to **SSH**. SonicWall also warned Generation 6 customers not to downgrade from patched firmware, saying a rollback will delete LDAP users and reset MFA configurations.
Jun 29, 2026