What happened. SonicWall confirmed two zero-day vulnerabilities in its Secure Mobile Access (SMA) 1000 series appliances are being actively exploited. CVE-2026-15409 (CVSS 10.0) is a server-side request forgery (SSRF) flaw a remote, unauthenticated attacker can use to force the appliance to make requests to an attacker-chosen location. CVE-2026-15410 (CVSS 7.2) is a post-authentication code-injection bug in the Appliance Management Console (AMC) that lets an authenticated attacker run arbitrary operating-system commands as administrator.

Who's affected. Organizations running SMA 1000 series appliances — the remote-access gateways that sit at the network edge and broker VPN connections into internal systems. These devices are internet-facing by design, which is exactly what makes an unauthenticated 10.0 on one of them a first-priority problem.

What to do now. Apply SonicWall's patch immediately; for an actively exploited edge device, nothing beats patching. Until you can, restrict Appliance Management Console access to trusted networks and review appliance logs for unexpected outbound requests or admin-level command execution. Because these are zero-days, assume exploitation may predate your patch and hunt backward.

Our read. Edge appliances are the assets an annual pentest looks at once and then not again for twelve months — while an attacker looks at them every day. In our analysis of the 2025 KEV catalog, 20% of actively-exploited vulnerabilities were already in use on or before the day they were publicly disclosed. A zero-day in an internet-facing gateway is the purest version of that gap: there is no disclosure-to-scan window at all. Coverage of the edge has to be continuous, not scheduled.

Reporting by The Hacker News and BleepingComputer; vulnerability details per SonicWall's advisory. Sources linked above.