SonicWall confirmed exploitation of two SMA1000 vulnerabilities. If compromise indicators are present, defenders must rebuild the appliance and reset credentials, not merely install the hotfix.