The U.S This article explores vulnerability sonicwall sma1000. . Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in the SonicWall SMA1000 device, identified as CVE-2026-15409, to its Known Exploited Vulnerabilities (KEV) catalog following real-world exploitation incidents.
The CVE-2023-45789, which has a CVSS score of 10.0, affects the SonicWall SMA1000 Appliance Workplace interface and allows for remote, unauthenticated attackers to force vulnerable devices into making unintended requests. A critical security flaw affecting SonicWall's SMA1000 Secure Socket Shell (SSHR) component has been exploited, allowing internet-facing Virtual Private Network (VPN) gateways to act as proxies for accessing backend services that should only be accessible from localhost or trusted internal connections. The U.S.
Initially described as a post-authentication code-injection issue in the SMA1000 Appliance Management Console, it was later identified by threat intelligence reports as a chain of vulnerabilities: the SSRF weakness allows access to internal appliance services, while the second flaw enables privilege escalation and root-level control. PSIRT observed pre-disclosure exploitation starting as early as June 22, weeks before SonicWall publicly released fixes. SonicWall advises reviewing the extraweb_access.log for unusual /__api__/login, /__api__/logout, and /wsproxy activity, examining ctrl-service.log for suspicious hotfix rollback events, and checking /var/lib/unit/conf.json for unauthorized routes.
Utilize in-browser data inspection from ANY.RUN to detect, investigate, and respond more swiftly, and gain comprehensive phishing visibility to bolster your SOC and reduce Mean Time To Repair (MTTR).
