Affected Systems

SonicWall Secure Mobile Access (SMA) 1000 appliances. Patched in versions 12.4.3-03670 (platform-hotfix) and 12.5.0-03082 (platform-hotfix) released October 6, 2026. All prior versions vulnerable.

Exploitation Status

Active exploitation confirmed. 135 exploitation attempts observed from two unique U.S.-based IP addresses starting October 8, 2026 (two days after patch release). Detected by Defused Cyber and Previdian threat intelligence firms.

Business Impact

Pre-authenticated SSRF (CVSS 10.0) allows remote attackers to force the appliance to issue internal requests, reach internal functionality, and perform unauthorized operations without credentials. SMA 1000 appliances are VPN/remote access gateways with privileged network position. Historical attacks on same product line (June 2026, CVE-2026-15409/15410) resulted in web shell deployment, credential harvesting, MFA seed theft, and lateral movement into corporate networks. High-value target for initial access and persistence.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately upgrade all SonicWall SMA 1000 appliances to version 12.4.3-03670 or 12.5.0-03082 (platform-hotfix) released October 6, 2026
  • Review SMA 1000 appliance logs from October 6, 2026 onward for suspicious internal requests, unauthorized API calls, or anomalous outbound connections indicating SSRF exploitation
  • Audit all credentials, active sessions, and TOTP MFA seed configurations accessible from SMA 1000 appliances; rotate credentials and reset MFA seeds if compromise suspected
  • Restrict network access to SMA 1000 management interfaces to trusted IP ranges only; implement additional network segmentation to limit lateral movement from appliance compromise
  • Monitor for indicators of web shell deployment (unusual Java processes, unexpected file writes to web directories) and review recent authentication logs for anomalous internal access patterns