Attackers exploit zero-days in consistently besieged SonicWall product

Two actively exploited zero-day vulnerabilities in SonicWall's SMA 1000 appliances — a server-side request forgery (SSRF) and an OS command injection flaw — can be chained together to achieve unauthenticated remote code execution, requiring no credentials from an attacker. This is especially dangerous because SMA 1000 devices are internet-facing network gateways, meaning successful exploitation grants attackers a direct foothold into enterprise networks. SonicWall has a documented history of being a high-value target for ransomware groups and nation-state actors, making its appliances a recurring weak link in perimeter defenses. The incident underscores the critical risk of relying on edge devices that lack compensating controls when patches are unavailable or delayed.