PT-2026-61591

threatreport LowCompleteness Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation | 17-07-2026 Source: https://t.co/LPIxpEauiy Key details below ↓ 🧑‍💻Actors/Campaigns: Uta0533 💀Threats: Xzfind tool, Rootrun tool, Knuckleball, Suo5 tool, Behinder, Orangetail, 🎯Victims: Vpn...

SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access

A previously undocumented threat actor has been attributed to the exploitation of recently disclosed SonicWall Secure Mobile Access SMA 1000 series VPN appliances as zero-days prior their public disclosure since June 22, 2026. Cybersecurity company Volexity is tracking the activity under the...

Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands

SonicWall has warned of active exploitation of two zero-day vulnerabilities impacting Secure Mobile Access SMA 1000 series appliances, one of which could be exploited to achieve arbitrary command execution. The vulnerabilities are listed below - CVE-2026-15409 CVSS score: 10.0 - A Server-side...

The vulnerability of the implementation of the SSL VPN micro-programming software for network interfaces of SONICWALL series SMA 1000 allows a intruder to gain unauthorized access to protected information.

The vulnerability of the implementation of the SSL VPN micro-programming software for network interfaces of the SMA 1000 series, SONICWALL, is related to inconsistencies in the responses to incoming requests. Exploiting this vulnerability can allow an attacker operating remotely to gain...

EUVD-2026-20908

Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/Connect Tunnel TOTP authentication...

PT-2026-31397

Name of the Vulnerable Software and Affected Versions SonicWall SMA1000 series appliances affected versions not specified Description Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/Connect Tunnel TOTP...

SonicWall SMA 1000 Series <= 12.4.3-03093 / 12.5.x <= 12.5.0-02283 Local Privilege Escalation (SNWLID-2025-0019)

The remote host is a SonicWall SMA 1000 Series device that may be affected by a local privilege escalation vulnerability: - A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console AMC. CVE-2025-40602 Note that Nessus has n...

The vulnerability of SonicWall SMA 100 series network intrusion prevention systems’ microprogramming software lies in their ability to download files of a malicious nature without limitation, allowing attackers to execute arbitrary codes.

The vulnerability of SonicWall SMA 100 network firewall microprogramming software is related to the unlimited loading of dangerous files. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

SonicWall Secure Mobile Access < 10.2.2.1-90sv (SNWLID-2025-0012)

The version of SonicWall Secure Mobile Access installed on the remote host is prior to 10.2.2.1-90sv. It is, therefore, affected by multiple vulnerabilities as referenced in the SNWLID-2025-0012 advisory: - A Reflected cross-site scripting XSS vulnerability exists in the SMA100 series web...

Sophos and SonicWall Patch Critical RCE Flaws Affecting Firewalls and SMA 100 Devices

Sophos and SonicWall have alerted users of critical security flaws in Sophos Firewall and Secure Mobile Access SMA 100 Series appliances that could be exploited to achieve remote code execution. The two vulnerabilities impacting Sophos Firewall are listed below - CVE-2025-6704 CVSS score: 9.8 - A...

SonicWALL SMA 代码问题漏洞

SonicWALL SMA is a security protection product for enterprise management security access applications from SonicWALL USA. A code issue vulnerability exists in the SonicWall SMA 100 that originates from an arbitrary file upload after authentication and could lead to remote code execution...

CVE-2022-22273

Improper neutralization of Special Elements leading to OS Command Injection vulnerability impacting end-of-life Secure Remote Access SRA products and older firmware versions of Secure Mobile Access SMA 100 series products, specifically the SRA appliances running all 8.x, 9.0.0.5-19sv and earlier...

CVE-2022-22279

A post-authentication arbitrary file read vulnerability impacting end-of-life Secure Remote Access SRA products and older firmware versions of Secure Mobile Access SMA 100 series products, specifically the SRA appliances running all 8.x, 9.0.0.5-19sv and earlier versions and Secure Mobile Access...

SonicWall SMA1000 Cross-Site Request Forgery Vulnerability

The SonicWALL SMA1000 is a series of secure mobile access solutions from SonicWALL, Inc. simplifies end-to-end secure remote access to enterprise resources hosted across local, cloud and hybrid data centers. The SonicWALL SMA1000 suffers from a cross-site request forgery vulnerability that stems...

SonicWALL SMA1000 代码问题漏洞

The SonicWALL SMA1000 is a series of secure mobile access solutions from SonicWALL, Inc. simplifies end-to-end secure remote access to enterprise resources hosted across local, cloud and hybrid data centers. The SonicWALL SMA1000 suffers from a cross-site request forgery vulnerability that stems...

SonicWall Secure Mobile Access DoS (SNWLID-2021-0022)

The version of SonicWall Secure Mobile Access installed on the remote host is prior to 9.0.0.11-31sv, or 10.2.1 prior to 10.2.1.1-19sv. It is, therefore, affected by a vulnerability as referenced in the SNWLID-2021-0022 advisory: - Improper neutralization of special elements in the SMA100...

SonicWall Secure Mobile Access < 10.2.1.10-62sv (SNWLID-2023-0018)

The version of SonicWall Secure Mobile Access installed on the remote host is prior to 10.2.1.10-62sv. It is, therefore, affected by multiple vulnerabilities as referenced in the SNWLID-2023-0018 advisory: - Improper neutralization of special elements in the SMA100 SSL-VPN management interface...

SonicWall Urges Immediate Patch for Critical CVE-2025-23006 Flaw Amid Likely Exploitation

SonicWall is alerting customers of a critical security flaw impacting its Secure Mobile Access SMA 1000 Series appliances that it said has been likely exploited in the wild as a zero-day. The vulnerability, tracked as CVE-2025-23006 , is rated 9.8 out of a maximum of 10.0 on the CVSS scoring...

SonicWALL SMA1000 代码问题漏洞

SonicWALL SMA1000 is a family of secure mobile access solutions from SonicWALL, Inc. that simplify end-to-end secure remote access to enterprise resources hosted across local, cloud and hybrid data centers. A security vulnerability exists in the SonicWALL SMA1000. An attacker exploiting this...

SonicWall Secure Mobile Access < 10.2.1.14-75sv (SNWLID-2024-0018)

The version of SonicWall Secure Mobile Access installed on the remote host is prior to 10.2.1.14-75sv. It is, therefore, affected by a vulnerability as referenced in the SNWLID-2024-0018 advisory. - Improper escaping of output in modrewrite in Apache HTTP Server 2.4.59 and earlier allows an...