Topic
SonicWall
CISA Adds Seven Actively Exploited Vulnerabilities to KEV Catalog, Including SonicWall and LiteLLM Flaws Targeting AI Infrastructure
Vulnerabilities & ExploitsSonicWall SMA 1000 Series Affected by Critical Vulnerabilities with Evidence of Exploitation
Vulnerabilities & Exploits
SonicWall Patches Critical Path Traversal and Update Flaws in NetExtender for Linux
Vulnerabilities & ExploitsSonicWall Global Management System Hit by Critical RCE and Path Traversal Vulnerabilities
SonicWall has disclosed six vulnerabilities in its SonicWall Global Management System (GMS) management product, with the highest-severity issues rated Critical. The most severe flaw, CVE-2026-66147, resides in the Dispatcher Service and allows unauthenticated remote code execution through crafted requests that inject commands. A second critical issue, CVE-2026-66145, stems from improper handling of zip archive extraction and enables path traversal attacks that can read sensitive data or write arbitrary files without authentication. Both vulnerabilities received CVSSv3 base scores above 9.0. The flaws affect both the virtual appliance and Windows versions of GMS. SonicWall released an advisory on August 11 urging immediate application of the available updates.
Weekly Roundup Highlights Critical Vulnerabilities in Zoom, nginx, SonicWall, and Microsoft Products
Security NEXT published its weekly ranking of the most-read articles for the period of July 12 to July 18, 2026. The top story covered a serious vulnerability in the Windows version of Zoom that has already been fixed in the latest release. Other high-ranking items included a cyber attack that disrupted operations at Nichirei and affected frozen food shipments, as well as Microsoft’s monthly security update addressing more than 500 vulnerabilities including zero-days. Additional widely read reports detailed multiple flaws in nginx, a zero-day issue affecting SonicWall SMA1000 series appliances, and a data exposure investigation involving a TV Asahi subsidiary. The list also featured advisories on GNU Wget SSRF flaws, privilege escalation bugs in Microsoft Defender, and 15 security fixes for Chrome including two rated critical.
SonicWall Issues Emergency Hotfixes After Detecting Active Exploitation of Two Zero-Day Vulnerabilities in SMA1000 Appliances
SonicWall has confirmed active exploitation of two zero-day vulnerabilities in its SMA1000 series appliances, prompting the immediate release of hotfixes and a strict compliance deadline for U.S. federal agencies. The first flaw, CVE-2026-15409, carries a critical CVSS score of 10.0 and allows unauthenticated server-side request forgery (SSRF) through the Appliance Work Place interface, enabling attackers to force the device to make unauthorized requests to internal services. The second vulnerability, CVE-2026-15410, rated CVSS 7.2, permits authenticated code injection via the Appliance Management Console, allowing administrators to execute operating system commands. Affected models include SMA6210, SMA7210, and SMA8200v running specific vulnerable platform versions such as 12.4.3-03245 through 12.5.0-02800. CISA has added both CVEs to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch or decommission impacted systems by July 17, 2026. Indicators of compromise and recommended response actions, including log analysis and potential appliance reimaging, have been published to help organizations detect and mitigate potential intrusions.
Cybercriminals Actively Exploiting Critical Zero-Day Vulnerabilities in SonicWall SMA1000 Appliances
Cybercriminals are actively exploiting a critical zero-day vulnerability in SonicWall SMA1000 appliances used for corporate remote access. The attack chain combines two flaws that together enable unauthenticated access to internal services and local privilege escalation, ultimately allowing remote code execution with maximum privileges on affected devices. The most severe issue, CVE-2026-15409, carries a maximum CVSS score of 10.0 and permits attackers to reach internal appliance services without authentication, while CVE-2026-15410 facilitates local privilege escalation. Impacted models include the SMA1000 Series 6210, 7210, and 8200v running firmware versions 12.4.3-03434 and 12.5.0-02800. SonicWall has confirmed that its SSL VPN firewalls and the SMA 100 product line remain unaffected. Compromised appliances have already been observed serving as stealthy entry points into corporate networks, where attackers harvested credentials, session data, and multi-factor authentication seeds before pivoting into Active Directory environments. Administrators are urged to apply the emergency patches that upgrade devices to firmware versions 12.4.3-03453, 12.5.0-02835, or later.