Max severity SonicWall SMA1000 flaw now exploited in attacks

A maximum-severity vulnerability in SonicWall SMA1000 appliances is being actively exploited in the wild shortly after a patch became available, highlighting the dangerously narrow window organizations have to remediate critical flaws in internet-facing devices. The flaw allows unauthenticated remote attackers to send arbitrary requests on behalf of the appliance, effectively enabling full compromise without any credentials. This follows a well-documented pattern of SMA1000 vulnerabilities being weaponized by ransomware groups, indicating these devices are high-value targets that threat actors monitor closely. Organizations that delay patching internet-facing remote access appliances even briefly face disproportionately high risk of breach.