--- title: Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero... description: Rapid7's MDR team discovered and disclosed two actively exploited zero-day vulnerabilities in SonicWall SMA1000 Series remote access appliances. CVE-2026-15409... canonical: https://daily.dev/posts/rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409--p3wy9hqt2 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days being Actively Exploited (CVE-2026-15409, CVE-2026-15410) | daily.dev og:description: Rapid7's MDR team discovered and disclosed two actively exploited zero-day vulnerabilities in SonicWall SMA1000 Series remote access appliances. CVE-2026-15409... og:url: https://daily.dev/posts/rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409--p3wy9hqt2 og:image: https://api.daily.dev/og/posts/p3wY9HQt2.png og:image:alt: Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days being Actively Exploited (CVE-2026-15409, CVE-2026-15410) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days being Actively Exploited (CVE-2026-15409, CVE-2026-15410) **[Rapid7 Cybersecurity Blog](https://daily.dev/sources/rapid7-blog)** · 8 min read · 0 upvotes · 0 comments ## Summary Rapid7's MDR team discovered and disclosed two actively exploited zero-day vulnerabilities in SonicWall SMA1000 Series remote access appliances. CVE-2026-15409 (CVSS 10.0) is a critical unauthenticated SSRF via a websocket proxy that allows attackers to tunnel to arbitrary localhost services, while CVE-2026-15410 is a path traversal-based local privilege escalation to root via the remove_hotfix workflow. Both CVEs are on CISA's KEV catalog. Observed attacks involved credential harvesting, MFA seed theft, and lateral movement into Active Directory via the compromised appliance. Affected versions span SMA1000 models 6210, 7210, and 8200v on firmware 12.4.3 and 12.5.0 branches. No workarounds exist; immediate upgrade to patched hotfix versions is required. IOCs, log patterns, attacker IP ranges, and a Python PoC are provided. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Another bad week for SonicWall as SMA 1000 0-day exploited](https://daily.dev/posts/another-bad-week-for-sonicwall-as-sma-1000-0-day-exploited-vbcm0llpl) · The Register · 0 upvotes · 0 comments - [CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs](https://daily.dev/posts/cisa-sonicwall-sma1000-flaws-now-exploited-by-ransomware-gangs-x9e9rvfsr) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409--p3wy9hqt2) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days being Actively Exploited (CVE-2026-15409, CVE-2026-15410)","url":"https://daily.dev/posts/rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409--p3wy9hqt2","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409--p3wy9hqt2"},"datePublished":"2026-07-15T16:48:03.801Z","dateModified":"2026-07-20T22:44:30.730Z","description":"Rapid7's MDR team discovered and disclosed two actively exploited zero-day vulnerabilities in SonicWall SMA1000 Series remote access appliances. CVE-2026-15409...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/403310fc83643451d0e643aaed18bd42?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/403310fc83643451d0e643aaed18bd42?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Rapid7 Cybersecurity Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Rapid7 Cybersecurity Blog","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/rapid7-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409--p3wy9hqt2","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,zero-day","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Rapid7 Cybersecurity Blog","item":"https://daily.dev/sources/rapid7-blog"},{"@type":"ListItem","position":3,"name":"Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days being Actively Exploited (CVE-2026-15409, CVE-2026-15410)"}]} ```