Unofficial Bash IoC checker for SonicWall SMA1000 appliances affected by actively exploited CVE-2026-15409 and CVE-2026-15410.
An unofficial Bash-based log check for selected indicators of compromise associated with the actively exploited SonicWall SMA 1000 Series vulnerabilities CVE-2026-15409 and CVE-2026-15410.
[!CAUTION] Independent community project: This repository is not affiliated with, endorsed by, maintained by, or supported by SonicWall or the German Federal Office for Information Security (BSI).
[!IMPORTANT] This script is a limited detection aid. A clean result does not prove that an appliance is uncompromised, and a match is not a complete forensic conclusion.
On 14 July 2026, SonicWall published security advisory SNWLID-2026-0008 for two zero-day vulnerabilities affecting the SMA 1000 Series. The vendor reported multiple investigated cases indicating exploitation in the wild.
On 15 July 2026, the BSI published BITS-H Nr. 2026-271845-1032, Version 1.0:
SonicWall SMA1000 – Zero-Day Schwachstellen aktiv ausgenutzt
Kritikalität 3 / Orange
The BSI recommends that security teams promptly implement protective measures and initiate forensic investigation.
The advisory covers the following SMA 1000 Series models:
Always consult the current SonicWall advisory to confirm affected versions and supported remediation.
A critical server-side request forgery vulnerability in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker may be able to cause the appliance to make requests to unintended locations.
A code-injection vulnerability in the SMA1000 Appliance Management Console. Under specific conditions, an authenticated administrator may be able to execute arbitrary operating-system commands remotely.
[!NOTE] Some shortened publications may show
CVE-2026-1541. The complete identifier is CVE-2026-15410.
SonicWall-SMA1000-Zero-Day-IoC-Check/
├── README.md
├── NOTICE.md
└── sonicwall-sma1000-ioc-check.sh
The script searches selected SMA1000 access and control-service logs for predefined patterns that may warrant further investigation.
It:
zgrep;It does not:
zgrep / GNU gzip utilities/var/log/aventailClone the repository:
git clone https://github.com/MrRawBit/SonicWall-SMA1000-Zero-Day-IoC-Check.git
cd SonicWall-SMA1000-Zero-Day-IoC-Check
Make the script executable:
chmod +x sonicwall-sma1000-ioc-check.sh
Run the script with root privileges:
sudo ./sonicwall-sma1000-ioc-check.sh
When no configured pattern is found:
No configured SMA1000 indicators of compromise were found.
A clean result does not prove that the appliance is uncompromised.
When at least one configured pattern is detected:
WARNING: Potential SMA1000 indicators of compromise were detected.
Preserve evidence, isolate the appliance when appropriate, and follow current incident-response and vendor guidance.
| Code | Meaning |
|---|---|
0 | No configured IoC pattern was detected |
1 | At least one configured IoC pattern was detected |
2 | A prerequisite or execution error occurred |
Exit code 2 includes missing root privileges, a missing zgrep command, a missing log directory, or no supported log files.
Example for automated workflows:
sudo ./sonicwall-sma1000-ioc-check.sh
result=$?
case "$result" in
0)
echo "No configured indicators detected."
;;
1)
echo "Potential compromise detected. Begin incident-response procedures."
;;
2)
echo "The check could not be completed. Review the error output."
;;
esac
The script currently searches for patterns involving:
The following files are checked:
/var/log/aventail/extraweb_access.log*
/var/log/aventail/ctrl-service.log*
Both plain-text and gzip-compressed rotated logs are included. The exact regular expressions are visible in sonicwall-sma1000-ioc-check.sh.
The SonicWall advisory identifies the following fixed platform-hotfix versions:
12.4.3-03453 or later12.5.0-02835 or laterVerify these versions against the current vendor advisory before making operational decisions.
When the script reports a possible indicator:
Where compromise is suspected or confirmed, follow the vendor's current guidance. This may include re-imaging physical appliances or redeploying virtual appliances, changing user and administrator passwords, and resetting TOTP tokens.
Do not rely on patching alone when compromise is suspected.
External references and vendor guidance can change. Treat the current SonicWall advisory as the authoritative source for affected versions, remediation, and updated indicators.
Contributions are welcome, particularly for:
Do not submit credentials, session tokens, customer information, unredacted production logs, internal hostnames, sensitive IP addresses, or unrelated exploit code.
Use this project only on systems that you own or are explicitly authorized to administer. Preserve evidence and follow applicable organizational, legal, contractual, and regulatory requirements during an investigation.
SonicWall, SMA, and related names may be trademarks of their respective owners. Their use in this repository is solely descriptive and does not imply affiliation, sponsorship, endorsement, or support.
The BSI publication is referenced for defensive-security context. This repository is not an official BSI publication or tool.
Review NOTICE.md before publishing or redistributing this project.
Do not add an open-source license until you have confirmed that you hold the necessary rights to redistribute the original script and detection logic. Renaming the script or changing its comments does not remove third-party copyright, attribution, or licensing obligations.
The software is provided without warranty of any kind. Use it at your own risk. All findings should be validated by qualified security personnel and compared with current official vendor guidance.