SonicWall SMA1000 Zero-Days Actively Exploited

THREAT INTELLIGENCE

Peer Review

4.8

Proven Trust

Dark blue circle with two overlapping checkmarks, one green and one light blue.

ISO 27001 text with a globe outline symbol on a black background.

2025 winner badge for Cyber Security Excellence Awards with gold and black design.

Critical

Other

September 1, 2026

Executive Summary

Actively exploited SSRF flaw and a post-authentication OS command injection threaten SMA1000 Work Place and Management Console.

Key Details

Affected Platform

Attack Surface

Network accessible, unauthenticated

Recommended Action

Apply vendor patch

Affected Environment

SonicWall SMA1000 appliances (models 6210, 7210, 8200v), versions 12.4.3-03453 and 12.5.0-02835 and earlier.

Operational Impact

Unauthorized access to sensitive functionality, and potential remote code execution, on exposed SMA1000 appliances.

Technical Root Cause

An unintended alternate access path enables pre-auth SSRF; improper command neutralization allows authenticated OS command injection.

Recommended Mitigation

Upgrade to fixed hotfix versions 12.4.3-03526 or 12.5.0-02952, or later, immediately after testing.

Concerned about your exposure?

Our security experts can help you assess affected systems, validate risk and support a safe remediation plan.

Discuss Your Security Exposure Explore Managed Detection and Response

Assess your risk

Identify affected systems

Plan remediation

Practical, vendor-aligned guidance

Get expert support

From our 24/7 security team

Stay ahead of emerging threats

Get the latest threat intelligence and security advisories from Smarttech247.

Full Technical Report

Download the complete analysis, including detailed technical findings and references.

Download Full Report (PDF)

References

SonicWall PSIRT Advisory, BleepingComputer.