Loading story…
Researchers detailed an attack chain dubbed SonicBoom affecting SonicWall SMA appliances, showing how attackers could move from stolen authentication tokens to remote shell access. The write-up ties the chain to CVE-2023-44221 and CVE-2024-38475, describing a path in which compromised session material can be leveraged to gain deeper access to the appliance.
The reports indicate the vulnerabilities can be combined to turn an initial foothold based on token theft into full command execution on affected SMA systems. The disclosure highlights the risk to organizations using SonicWall Secure Mobile Access appliances, where exposed or previously compromised tokens could enable attackers to escalate privileges and obtain a shell on the device.
Map this exposure pattern across your cloud, code, and identities.
1 event from the most recent confirmed update back to the earliest known activity.
A security write-up titled "SonicBoom, From Stolen Tokens to Remote Shells" described an attack path affecting SonicWall SMA involving CVE-2023-44221 and CVE-2024-38475, connecting stolen tokens to remote shell access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
labs.watchtowr.com
Open sourcesummoning.team
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SonicWall has released urgent patches for a local privilege escalation vulnerability (CVE-2025-40602) in its Secure Mobile Access (SMA) 1000 appliances, following reports of active exploitation in the wild. Attackers have been chaining this flaw with a previously patched deserialization vulnerability (CVE-2025-23006) to achieve unauthenticated remote code execution with root privileges on affected devices. The vulnerabilities impact the Appliance Management Console (AMC) and Central Management Console (CMC), and SonicWall has advised customers to upgrade to the latest hotfix versions and restrict management interface access to mitigate risk. Security advisories from multiple sources, including government agencies and SonicWall itself, emphasize the criticality of patching due to the widespread use of SMA1000 appliances in large enterprises and critical infrastructure. Over 950 internet-exposed SMA1000 devices have been identified, heightening concerns about potential exploitation. No indicators of compromise have been released, but organizations are urged to apply the fixes immediately and review their exposure to the AMC and SSH interfaces to prevent further attacks.
Jul 23, 2026
SonicWall disclosed four vulnerabilities in **Secure Mobile Access (SMA) 1000** series appliances that could allow **SQL injection-based privilege escalation**, **unauthenticated user credential enumeration**, and **multi-factor authentication bypass**. The issues affect SMA 1000 deployments through flaws in SQL handling and Unicode processing, with the most severe bug tracked as **`CVE-2026-4112`** and rated **CVSS 7.2**. SonicWall said the vulnerabilities do **not** impact SSL-VPN functionality on standard SonicWall firewalls. According to SonicWall's advisory **`SNWLID-2026-0003`**, the Unicode-related flaws can bypass **TOTP** protections in **AMC**, **Workplace**, or **Connect Tunnel** authentication flows, increasing the risk of unauthorized access. SonicWall said it has **no evidence of active exploitation** and provided **hotfixes and fixed releases** for affected SMA 1000 versions, adding that **no workarounds or alternative mitigations are available**, making patching the required response for exposed systems.
Jun 29, 2026
SonicWall disclosed active exploitation of two vulnerabilities in **SMA1000-series SSL VPN appliances**: `CVE-2026-83548`, a critical pre-authentication server-side request forgery (SSRF) flaw with a CVSS score of 10.0, and `CVE-2026-83549`, a high-severity post-authentication OS command-injection flaw. The SSRF issue stems from an unintended forward-proxy access path in the Work Place interface and may enable unauthenticated attackers to reach internal resources or potentially execute commands; the command-injection flaw enables authenticated administrators to run arbitrary operating-system commands through the Appliance Management Console. SonicWall has issued hotfix firmware and urged customers to apply it immediately. Organizations operating affected appliances should restrict access to the Work Place and administrative interfaces, monitor appliances for anomalous outbound connections, and review administrator activity and appliance logs for indicators of compromise.
Sep 8, 2026