SonicWall
CISA Confirms Exploitation of SonicOS SSLVPN Authentication BypassNew!!
CISA confirms SonicOS SSLVPN exploitation. Upgrade affected Gen7 or Gen8 systems, verify SAML and MFA enforcement, and retain authentication evidence.
CVE-2026-15410: SonicWall SMA1000 administrator code injection
This SMA1000 code-injection flaw requires administrator access to the Appliance Management Console. Apply the current supported hotfix and investigate suspected compromise; the historical minimum build does not establish protection against later vulnerabilities.
CVE-2026-15409: SonicWall SMA1000 unauthenticated WorkPlace SSRF
Unauthenticated requests can make the SMA1000 WorkPlace interface contact unintended destinations. Verify the appliance model and hotfix, update, and conduct the compromise review; SonicWall firewall SSL-VPN and SMA 100 are outside this notice's scope.
CVE-2026-83549: SonicWall SMA1000 administrator command injection and RCE
SonicWall SMA1000 administrators can exploit command injection through the Appliance Management Console. Apply the supported hotfix and request a support-led compromise review; this is distinct from the separate unauthenticated WorkPlace flaw.
CVE-2026-83548: SonicWall SMA1000 pre-authentication SSRF and proxy bypass
An unintended SMA1000 WorkPlace proxy path can expose sensitive functionality without authentication. Install SonicWall's supported hotfix, preserve exposure history, and obtain a support-led indicator review rather than treating the update as proof of recovery.