SonicWall SMA1000: Two actively exploited 0-days, potentially chainable

The Register and The Hacker News reported on September 2, 2026, that SonicWall SMA1000 appliances are once again under active attack, with two zero-days capable of forming a full exploit chain. Immediate operational priority.

Key Facts

Two reports were published on September 2, 2026:

• The Register reports that SonicWall SMA1000 appliances are “under active attack again” — implying this is not the first wave targeting this product.
• The Hacker News documents two SMA1000 0-days being exploited by attackers and notes they could form an attack chain — meaning one enables initial access, the other privilege escalation or code execution, giving full control of the appliance.

We are tracking this as part of a series of critical RCE flaws affecting enterprise platforms (SAP, ServiceNow with three CVSS 10.0 CVEs, Ivanti, MOVEit). SonicWall SMA1000 is a Secure Mobile Access (SMA) gateway deployed at the enterprise perimeter — historically the most targeted class of product by ransomware groups.

Who Is Affected

• Any organization deploying SonicWall SMA1000 at the perimeter (VPN access, SSL/TLS portals for remote employees).
• MSSPs (managed security service providers) operating these appliances for clients.
• Regulated sectors (healthcare, finance, public services) that widely use such appliances for compliant remote access.

Why This Matters

Perimeter remote access appliances have been a favored vector for ransomware groups since 2020. The pattern is familiar: a critical CVE drops, a public exploit circulates, ransomware affiliates scan the internet within hours.

Three aggravating factors are present here:

1. The “again” from The Register — SonicWall SMA1000 is no stranger to alerts. Each new wave finds a poorly patched fleet because prior warnings were not addressed in time.
2. The potential chain — two chainable 0-days typically allow moving from “unauthenticated” to “root” in a single request. This is the hallmark of mass-scale attacks.
3. Visibility — an SMA1000 appliance sits at the perimeter, reachable from the internet by design. There is no “protective segmentation”: it is exposed.

Immediate Actions

• Isolate any unpatched SMA1000 immediately: if you cannot patch within the hour, cut internet access. Availability can wait; compromise cannot.
• Hunt for IoCs: check SonicWall PSIRT advisories from the last 48 hours, apply recommended detection rules, and cross-reference logs (unusual VPN sessions, local account creation on the appliance, configuration exports).
• Restore rather than clean: a compromised perimeter appliance is a lost trust asset. Backup config → wipe → reflash patched firmware → reintegration.
• Audit lateral movement: if the appliance served as a bridge, attackers are already inside. Hunt for recently created accounts, unusual RDP sessions, outgoing exfiltration.

Takeaway: perimeter remote access appliances remain in 2026 the preferred entry point for ransomware groups. Every SonicWall/Fortinet/Ivanti/Palo Alto advisory must be treated as a P0 alert, regardless of CVSS score. Here, two active, chainable 0-days: do not delay.