Two Sonic Wall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands
Summary: SonicWall warned of active exploitation of two zero-day vulnerabilities in Secure Mobile Access (SMA) 1000 series appliances, one of which could enable arbitrary command execution, and said it investigated multiple cases indicating active exploitation. CISA added both flaws to its KEV catalog with a July 17, 2026 remediation deadline for FCEB agencies, while Rapid7 reported targeted exploitation of internet-facing SMA 1000 appliances since at least late June 2026, with attackers chaining the two flaws to take control of devices.
What's compelling: Rapid7 found attackers used the compromised appliance to harvest credentials, active session databases, and TOTP MFA seed configurations, then moved laterally into the internal network through VPN-less Active Directory authentications from the appliance's own IP - persistent access designed to survive standard network-level remediations.
Read the original at The Hacker News ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026