Hackers Exploit SonicWall SMA1000 Zero-Days to Execute Commands as Root

Rapid7 observed active exploitation of two zero-day vulnerabilities in SonicWall SMA 1000 Series appliances—CVE-2026-15409 (CVSS 10.0) enables an unauthenticated WebSocket-based SSRF to access internal services (e.g., Erlang on localhost:1050), and CVE-2026-15410 allows privilege escalation via a path-traversal in the ctrl-service rollback flow to execute a malicious script as root; the flaws have been added to CISA’s Known Exploited Vulnerabilities catalog, SonicWall released hotfixes (12.4.3-03453 / 12.5.0-02835 or later), and organizations are advised to patch immediately, investigate appliances for compromise, re-image or redeploy as needed, and rotate credentials/TOTP tokens.