Bottom line: Unpatched zero-day vulnerabilities in SonicWall SMA1000 are already being actively exploited.
SonicWall has warned of active attacks on previously unknown security vulnerabilities in SMA1000 appliances. The vendor has provided a hotfix and indicators of compromise (IOCs).
SonicWall is reporting active attacks on critical zero-day vulnerabilities in its SMA1000 appliances, which are widely used as SSL VPN gateways. The affected devices are deployed in many enterprise networks as remote access solutions and provide secure access to internal resources.
The security risk lies in the fact that the vulnerabilities were unknown at the time of the attacks and therefore no patches existed. SonicWall has subsequently provided a hotfix and published indicators of compromise to help administrators with detection and response.
CISOs should immediately verify whether SMA1000 appliances are operating in their infrastructure and implement the provided IOCs in their security systems. The hotfix should be deployed promptly after thorough validation, as the VPN gateway represents a critical component of network security and a compromise could allow broad access to the internal network.
Source: www.heise.de · Published 15 July 2026
Lumi AI News — AI-assisted curation pursuant to Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.