CISA Adds SonicWall SMA1000 Vulnerabilities to KEV Catalog Following Active Exploitation

**Executive summary:** SonicWall SMA1000 Series appliances are affected by two critical vulnerabilities—CVE-2026-15409 (unauthenticated SSRF, CVSS 10.0) and CVE-2026-15410 (post-authentication code injection, CVSS 7.2)—that are being actively exploited in the wild; SonicWall and CISA recommend immediate upgrade to hotfix releases (12.4.3-03453+ and 12.5.0-02835+) and provide IOCs and remediation steps including log inspection, re-imaging/redeployment, credential resets, and TOTP token resets.