SonicWall SMA1000 gateways hit by chained zero-day exploits enabling network access

SonicWall’s SMA1000 appliances are under active attack due to two chained zero-day vulnerabilities. The first, a pre-authentication SSRF flaw, allows unauthenticated attackers to access sensitive functionality. The second, a post-authentication OS command injection bug, enables authenticated administrators to execute arbitrary commands. Together, these flaws create a high-risk scenario for enterprises relying on these gateways for secure remote access.

The vulnerabilities affect specific SMA1000 models, and SonicWall has released hotfixes to address them. However, there are no workarounds, meaning organizations must apply the patches immediately. For compromised appliances, SonicWall recommends reimaging or redeploying the device, resetting all passwords, and revoking TOTP tokens. This process adds operational overhead and potential downtime for affected teams.

This incident is part of a broader pattern of attacks targeting SonicWall’s SMA1000 line. In 2025, similar chained zero-days were exploited in ransomware campaigns, leading to CISA’s inclusion of one such flaw in its Known Exploited Vulnerabilities catalog. The recurrence of these attacks suggests persistent targeting of edge devices, which are inherently exposed to the internet and attractive to attackers.

Third-party security operations centers (SOCs) have warned that further exploitation of these vulnerabilities is 'almost certain.' This aligns with broader trends, as edge devices like firewalls and VPN gateways are increasingly targeted due to their critical role in network security. Organizations must prioritize patching and monitoring these devices to mitigate the risk of unauthorized access or lateral movement within their networks.