SonicWall SMA1000, 2026: three waves, one Work Place interface

Format: operator advisory (lab-note, evidence-first)

Pillar: Threat Intel / Remote-access appliances

Synthesis date: 2026-10-19

Cross-link: SMA1000 CVE-2026-15409 / 15410 active exploitation (July wave)

The recurring pattern, in one paragraph

The SMA1000 is a remote-access appliance. It sits on the internet edge and carries the people who need to get in. In 2026 it produced three separate security events, and two of them (July, September) were zero-days that CISA put on the Known Exploited Vulnerabilities list the same week they shipped. The same Work Place interface is behind all three pre-auth server-side request forgery flaws: CVE-2026-15409 (July), CVE-2026-83548 (September), and CVE-2026-102255 (October).[10][15][1] A single product line, one interface, three pre-auth SSRF bugs in one year, with the July and September pairs confirmed exploited in the wild. The October wave is the current state of that pattern: patched, not yet confirmed exploited, and not in KEV as of the 2026.10.16 catalog.[5][1]

2026 SMA1000 wave timeline (verified)

Sources for the table. PSIRT advisories and product notices for each wave (0008, 0016, 0017): [1][2][3]. CISA KEV JSON feed for KEV status and dates: [5]. NVD records for the October CVSS values: [6][7][8]. Secondary reporting for the July wave's fixed versions and pre-disclosure exploitation observation: [16][17][18].

Wave-by-wave notes

July (SNWLID-2026-0008). Two flaws: a pre-auth SSRF in the Work Place interface (15409, CVSS 10.0) and a post-auth code injection in the Appliance Management Console (15410, CVSS 7.2). SonicWall confirmed active exploitation in the wild. Rapid7's MDR team observed targeted zero-day exploitation of internet-facing SMA1000 appliances before the official disclosure, and reported that threat actors used the appliance as a stealthy initial-access vector, then extracted credentials and TOTP data.[16] Both CVEs were added to KEV on 2026-07-14 with a 2026-07-17 due date and a "Known" ransomware campaign flag.[5] Fixed in 12.4.3-03453 and 12.5.0-02835.[17]

September (SNWLID-2026-0016). A pre-auth SSRF in the Work Place interface (83548, CVSS 10.0) and a post-auth OS command injection in the AMC (83549, CVSS 7.8). SonicWall confirmed active exploitation, and the discovery came internally from Triskele Labs. The two flaws can be chained: the pre-auth SSRF opens the door and the command injection runs code, producing unauthenticated remote code execution on the appliance.[15] Both CVEs were added to KEV on 2026-09-02 with a 2026-09-05 due date; ransomware use is marked "Unknown."[5] Fixed in 12.4.3-03526 and 12.5.0-02952.[4]

October (SNWLID-2026-0017). Four flaws, detailed below. SonicWall states there is currently no evidence the October wave is being exploited in the wild, and credits 102255 and 102256 to Benoit Sevens of Anthropic, 102257 to Brian Mariani through ZDI (ZDI-CAN-28924), and 102258 to Brian Mariani (DigitalCanion SA).[1] The four CVEs are not in KEV as of the 2026.10.16 catalog.[5] Fixed in 12.4.3-03670 and 12.5.0-03082.[13]

The October wave in detail

102255 is a pre-auth SSRF in the Work Place interface, the same interface that produced the July and September zero-days. An unauthenticated remote attacker can direct the appliance to issue requests on their behalf and reach internal functionality. NVD's SSVC rates it "automatable: yes" and "exploitation: none," the only one of the four rated automatable.[6][10]

The three remaining flaws (102256, 102257, 102258) are post-auth and require an authenticated administrator. 102256 is an OS command injection in the AMC that can lead to RCE. 102257 is a Zip Slip in the AMC archive-extraction path that can lead to RCE. 102258 is a stored XSS in the AMC.[7][8][9]

102258 score conflict. The vendor advisory rates 102258 at 5.5. The NVD record shows 6.1, with a vector (PR:N, UI:R) that contradicts its own post-authentication description. A stored XSS that requires an authenticated attacker to inject but a victim to trigger is normally scored with PR:L or PR:H, not PR:N. Use the vendor score (5.5) for publication and flag the NVD record for correction.[9][1]

NVD data lag. The NVD "affected" version field for all four October CVEs points at the September hotfix boundary (12.4.3-03526 and 12.5.0-02952), one release behind the October fix. Use the vendor fixed versions (12.4.3-03670 and 12.5.0-03082), not the NVD affected-version boundary.[6][7][8]

The rolling ceiling

Each wave's fixed build becomes the next wave's vulnerable ceiling. The chain runs 03453/02835 → 03526/02952 → 03670/03082. The October advisory's affected list (12.4.3-03526 and older / 12.5.0-02952 and older) includes the July and September fixed builds. In other words, "patched in July" is no longer safe, and "patched in September" is no longer safe. Only 12.4.3-03670 and 12.5.0-03082 (or higher) are currently safe against all three 2026 waves.[1][3][4]

Exploitation status, stated precisely

• July wave: actively exploited, vendor-confirmed, KEV with "Known" ransomware flag.
• September wave: actively exploited, vendor-confirmed, KEV with "Unknown" ransomware flag.
• October wave: no evidence of in-the-wild exploitation per the vendor. Not in KEV as of the 2026.10.16 catalog.

One caveat on the October wave. After the patch shipped, third-party sensors observed probing of 102255. Defused Cyber and Previdian reported 135 exploitation attempts from two U.S.-based IP addresses on 2026-10-08/09, against honeypot and decoy systems. SonicWall has not updated the advisory to reflect active exploitation, and the CVEs are not in KEV. That is third-party sensor observation, not vendor-confirmed exploitation. Do not state the October wave is actively exploited in the wild on the basis of that probing alone.[19][20][1]

KEV is a lagging indicator. Absence from the catalog means "no confirmed known exploitation recorded by CISA," not "no exploitation exists." The October wave could still be added later.[5]

Operator advisory for SMA1000 fleets

The SMA1000 is a single point of failure for remote access. IONIX frames the SMA1000 as an internet-facing remote-access gateway whose critical severity and role justify prioritized patching.[11] If you run an SMA1000 (models 6210, 7210, 8200v, all hypervisors), do the following.

1. Check the running firmware build against the fixed versions.

The safe builds are 12.4.3-03670 and 12.5.0-03082 (or higher). Verify the exact platform-hotfix level, not just the main firmware branch. If you are on 12.4.3-03526 or 12.5.0-02952 (the September fix), you are still vulnerable to the October wave. If you are on 12.4.3-03453 or 12.5.0-02835 (the July fix), you are vulnerable to both the September and October waves.

2. Confirm the running build after the upgrade.

After applying the platform-hotfix, confirm in the appliance management interface that the running build is the fixed version. SecPod calls this out as a concrete verification step that is easy to skip.[12]

3. Restrict WorkPlace internet exposure until patched.

The pre-auth SSRF flaws (15409, 83548, 102255) all live in the Work Place interface. Where operationally possible, limit unnecessary internet exposure of the Work Place interface until the fixed software is in place. IONIX and SecPod both recommend this as an interim control.[11][12]

4. Review access logs for compromise indicators.

The July post documents specific indicators to look for: extraweb_access.log for /__api__/login and /__api__/logout (HTTP 200), /wsproxy with suspicious host parameters (HTTP 101), ctrl-service.log for hotfix rollbacks with path-traversal names, and /var/lib/unit/conf.json for /__api__/login or /__api__/logout routes. Review these on any appliance that was internet-facing and running a pre-03670/03082 build.[14]

5. Reset credentials and MFA if compromise is suspected.

If you find an indicator of compromise, the vendor's remediation is to re-image the appliance (hardware) or re-deploy it (virtual), change all user and admin passwords, and reset TOTP tokens. The July post's immediate response plan is: identify devices, isolate exposed admin paths, apply the hotfix, collect and review logs, rebuild if an indicator is present, rotate credentials, reset TOTP, and review IdP/VPN/admin activity.[14][4]

6. Do not depend on one vendor appliance for access.

The SMA1000 is a recurring single point of failure: three 2026 waves, two of them zero-days, all on one interface. If the only path in is a single unpatched build, that is a full perimeter breach. Check the firmware build against the fixed list, and do not make one vendor appliance the sole dependency for access.

Cross-link to the existing Malwlab post

The existing post covers the July wave only (15409/15410). It does not cover the September or October waves, and it does not articulate the rolling-ceiling pattern or the 2025 KEV context. The new advisory should cross-link to the existing post as the first wave in the 2026 sequence and note that the July post's fixed versions (12.4.3-03453 / 12.5.0-02835) are now within the October wave's affected range. There is no content overlap between the July post and this advisory.[14]

2025 KEV context

The SMA1000 line has KEV-listed exploitation in 2025 as well: CVE-2025-23006 (deserialization, added 2025-01-24) and CVE-2025-40602 (missing authorization, added 2025-12-17). The recurring pattern is not new to 2026. The appliance line has been on the KEV list in January and December 2025, then July and September 2026, with the October 2026 patch still unexploited as of this check.[5]

Discrepancies and uncertainty notes

1. 102258 score conflict: vendor 5.5 vs NVD 6.1. The NVD vector (PR:N, UI:R) contradicts its own post-auth description. Use the vendor score; flag the NVD record for correction.[9][1]
2. NVD affected-version lag: the NVD affected field points at the September hotfix boundary, one release behind the October fix. Use vendor fixed versions.[6][7][8]
3. October exploitation status: the vendor states no evidence of in-the-wild exploitation. Third-party sensors (Defused Cyber, Previdian) observed 135 probing attempts from two U.S. IPs on 2026-10-08/09. This is not vendor-confirmed exploitation and is not in KEV. Do not claim active exploitation on the basis of the probing alone.[19][20][1]
4. KEV is a lagging indicator: absence from the catalog is not proof of no exploitation. The October wave could still be added later.[5]
5. tech-insider.org CVSS conflict: a secondary source (tech-insider.org) lists different CVSS scores for 102256/102257/102258 (8.8 / 8.1 / 7.2) that contradict the vendor scores (7.8 / 7.2 / 5.5). The vendor scores are confirmed by Tenable's NVD mirror. Use vendor scores.[1][2]

Sources

1. https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017 — SonicWall PSIRT SNWLID-2026-0017 (October 2026 advisory)
2. https://www.sonicwall.com/support/notices/product-notice-sma-1000-series-affected-by-multiple-vulnerabilities-snwlid-2026-0017/kA1VN000002QP3G0AW — SonicWall product notice SNWLID-2026-0017
3. https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 — SonicWall PSIRT SNWLID-2026-0016 (September 2026 advisory)
4. https://www.sonicwall.com/support/notices/product-notice-sma-1000-series-affected-by-multiple-vulnerabilities-snwlid-2026-0016/kA1VN000002AXmQ0AW — SonicWall product notice SNWLID-2026-0016
5. https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json — CISA Known Exploited Vulnerabilities (KEV) catalog JSON feed
6. https://nvd.nist.gov/vuln/detail/CVE-2026-102255 — NVD CVE-2026-102255
7. https://nvd.nist.gov/vuln/detail/CVE-2026-102256 — NVD CVE-2026-102256
8. https://nvd.nist.gov/vuln/detail/CVE-2026-102257 — NVD CVE-2026-102257
9. https://nvd.nist.gov/vuln/detail/CVE-2026-102258 — NVD CVE-2026-102258
10. https://www.helpnetsecurity.com/2026/10/07/sonicwall-fixes-pre-auth-ssrf-flaw-in-sma-1000-appliances-cve-2026-102255 — Help Net Security (2026-10-07)
11. https://www.ionix.io/threat-center/cve-2026-102255 — IONIX Threat Center CVE-2026-102255 alert
12. https://www.secpod.com/learn/security-research/critical-sonic-wall-sma-1000-flaw-lets-unauthenticated-attackers-reach-internal-functionality — SecPod (2026-10-08)
13. https://asec.ahnlab.com/en/95818 — AhnLab ASEC (2026-10-13)
14. https://blog.malwlab.se/sonicwall-sma1000-cve-2026-15409-15410-active-exploitation — Malwlab post: SMA1000 CVE-2026-15409/15410 active exploitation (July wave)
15. https://www.rapid7.com/blog/post/etr-critical-sonicwall-sma1000-vulnerabilities-cve-2026-83548-cve-2026-83549-exploited-in-the-wild — Rapid7 (2026-09-01): 83548/83549 exploited, chain to unauth RCE
16. https://www.rapid7.com/blog/post/etr-rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410 — Rapid7 (2026-07-15): 15409/15410 zero-day, pre-disclosure exploitation
17. https://www.esentire.com/security-advisories/sonicwall-discloses-two-zero-day-vulnerabilities-cve-2026-15409-cve-2026-15410 — eSentire (2026-07-14): 15409/15410 fixed versions
18. https://www.helpnetsecurity.com/2026/07/14/sonicwall-sma-attacks-via-cve-2026-15409-cve-2026-15410 — Help Net Security (2026-07-14): 15409/15410 KEV, due 2026-07-17
19. https://thehackernews.com/2026/10/critical-sonicwall-sma-1000-flaw.html — The Hacker News (2026-10): 102255 post-patch probing, 135 attempts, Defused Cyber + Previdian
20. https://www.securityweek.com/critical-sonicwall-vulnerability-exploited-days-after-disclosure — SecurityWeek (2026-10): 102255 exploited days after disclosure