SonicWall warns of active exploitation of two SMA 1000 zero-days

SonicWall warns that two zero-day vulnerabilities in SMA1000 appliances—CVE-2026-15409 (SSRF, CVSS 10.0) and CVE-2026-15410 (post-auth code injection, CVSS 7.2)—are being actively exploited; the advisory lists affected versions, available hotfix releases, recommended log/IOC checks (unusual API requests, suspicious WebSocket proxy connections, path traversal/hotfix rollback evidence, unauthorized API routes), and urges immediate patching and full forensic remediation if compromise is suspected.