Critical SonicWall Firewall CVE-2021-20021, CVE-2021-20022 Zero-Days Actively Exploited

Key Takeaways

• SonicWall has issued an urgent advisory for two zero-day vulnerabilities, CVE-2026-15409 and CVE-2026-15410, actively exploited in the wild.
• The flaws affect specific versions of SonicWall SMA1000 Series appliances, particularly models 6210, 7210, and 8200 running platform-hotfix releases 12.4.3 and 12.5.0.
• CVE-2026-15409 is a critical unauthenticated server-side request forgery (SSRF) with a CVSS score of 10.0, while CVE-2026-15410 is a post-authentication code injection with a CVSS score of 7.2.
• Patches are available, and immediate application of hotfixes 12.4.3-0345 or 12.5.0-0283 (or later) is strongly recommended.

SonicWall has released a critical security advisory warning customers about two zero-day vulnerabilities actively being exploited in the wild. These flaws impact specific versions of the company’s SMA1000 Series appliances and pose a significant risk to affected organizations.

The most severe of the two, identified as CVE-2026-15409, carries a maximum CVSS score of 10.0. This vulnerability allows for remote exploitation without requiring any authentication, making it particularly dangerous.

The vulnerabilities specifically target SonicWall SMA1000 models 6210, 7210, and 8200. Affected devices are those running certain platform-hotfix releases, namely 12.4.3 and 12.5.0.

Critical SonicWall Firewall Zero-Day Vulnerabilities

SonicWall has clarified that its SSL-VPN services on firewall products and the SMA 100 Series appliance line are not affected by these issues. CVE-2026-15409 is a server-side request forgery (SSRF) vulnerability present in the SMA1000 Workplace interface.

This critical flaw enables an unauthenticated remote attacker to compel a vulnerable appliance to send requests to arbitrary internal or external network locations. Such SSRF vulnerabilities can grant attackers access to services typically isolated from the internet, facilitate internal network reconnaissance, or serve as a stepping stone for further system compromise.

The second vulnerability, CVE-2026-15410, is a post-authentication code injection flaw found within the SMA1000 Appliance Management Console. This issue has a CVSS score of 7.2.

Under specific circumstances, an attacker with authenticated administrator access could leverage this vulnerability to execute arbitrary operating system commands on the appliance. While requiring prior authentication, a successful exploit could lead to full control over the compromised system if an attacker manages to obtain valid credentials or hijack an administrative session.

The SonicWall Product Security Incident Response Team (PSIRT) has confirmed active exploitation of both vulnerabilities through multiple incident investigations. While specific details regarding the threat actors or attack methodologies have not been publicly disclosed, SonicWall is strongly urging immediate patching due to the absence of any available workarounds.

Organizations utilizing affected SMA1000 appliances must upgrade to platform-hotfix version 12.4.3-0345 or later for the 12.4.3 branch, or version 12.5.0-0283 or later for the 12.5.0 branch. These hotfixes are accessible via the MySonicWall customer portal.

Administrators should also conduct thorough reviews of appliance logs and configuration files for potential signs of compromise. SonicWall identified suspicious HTTP 200 responses for requests to /api/login or /api/logout in extraweb_access.log as potential indicators of compromise.

Other warning signs include HTTP 101 responses for requests to /wsproxy with suspicious host parameters, as well as hotfix rollback entries exhibiting path traversal-like names within ctrl-service.log. Furthermore, administrators should inspect /var/lib/unit/conf.json for any routes involving /api/login or /api/logout, as these paths are not part of legitimate SMA1000 configurations.

SonicWall credited PSIRT researcher Adam Babis for reporting these vulnerabilities. The company also extended its gratitude to Sean Koessel and Steven Adair of Volexity for their assistance in the investigation and their contributions to identifying an additional indicator of compromise.

What You Should Do

• Immediately apply the required hotfixes: upgrade SMA1000 appliances to platform-hotfix version 12.4.3-0345 (or later) for the 12.4.3 branch, or 12.5.0-0283 (or later) for the 12.5.0 branch.
• Thoroughly review appliance logs (extraweb_access.log, ctrl-service.log) and configuration files (/var/lib/unit/conf.json) for any indicators of compromise as outlined in the advisory.
• If any evidence of compromise is detected, re-image affected hardware appliances or redeploy virtual appliances.
• Reset all user and administrator passwords, and reset time-based one-time password (TOTP) tokens to invalidate any potentially stolen authentication credentials.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.