Two zero-days, chained together, turned a remote access appliance into a long-term backdoor
SonicWall confirmed active exploitation this week — and patching alone will not evict the attacker.
CVE-2026-15409 (CVSS 10.0) — unauthenticated SSRF in the SMA1000 Work Place interface. CVE-2026-15410 (CVSS 7.2) — post-auth code injection in the Management Console. Rapid7's MDR team traced exploitation back to June 22.
WHAT ACTUALLY HAPPENED
Attackers chain the two flaws: the SSRF bug gets them in without credentials, the code injection bug gives them arbitrary OS command execution once inside. From there they are not just planting a webshell — they are extracting high-value credentials, active session databases, and TOTP multi-factor authentication seed configurations. That last item is the one worth pausing on.
Affected models: SMA6210, SMA7210, SMA8200v. Hotfixes are out — v12.4.3-03453 and 12.5.0-02835. Federal agencies have until July 17 under BOD 26-04 to remediate or take the appliance offline.
WHY THE MFA SEED THEFT CHANGES THE MATH
Standard incident response after a credential compromise is: rotate passwords, force re-authentication, move on. That playbook assumes MFA is still trustworthy. If an attacker exfiltrated your TOTP seed configurations, they can generate valid one-time codes indefinitely — password rotation does nothing, because the second factor was never actually theirs to lose in the first place. This is a persistence mechanism disguised as a login.
WHAT TO DO NOW
APPLY THE HOTFIXES IMMEDIATELY — v12.4.3-03453 or 12.5.0-02835 depending on your branch, no exceptions for "scheduled maintenance windows."
ASSUME MFA IS COMPROMISED, NOT JUST CREDENTIALS — reissue TOTP seeds for every account with SMA1000 access, not just passwords.
HUNT FOR SSRF-ORIGINATED OUTBOUND REQUESTS SINCE JUNE 22 — that is the earliest confirmed exploitation date, not when SonicWall disclosed it.
TAKE THE APPLIANCE OFFLINE IF YOU CANNOT PATCH BEFORE JULY 17 — BOD 26-04 treats "still vulnerable" and "still exposed" as the same failure.
A stolen password is a problem you can fix in a day. A stolen MFA seed is a problem that outlives your incident response unless you know to look for it.
Does your IR playbook include TOTP seed rotation, or does it stop at password resets?