SonicWall shipped patches this week for two zero-day vulnerabilities in its SMA 1000 series Secure Mobile Access appliances, already chained together in active exploitation to achieve unauthenticated remote code execution. The SMA 1000 sits at the network edge by design, terminating VPN sessions before anything reaches internal authentication. That is precisely why a pre-auth chain on it is not a routine patch cycle item.

This is the second SonicWall edge-device zero-day disclosure of the summer, following earlier attacks on a different pair of flaws in the same product line. For a CISO who patched the last SonicWall advisory and moved on, the relevant control is not the update queue. It is whether SMA 1000 appliances still need to be internet-facing at all, given two zero-day chains on the same product line inside one quarter.