cyber.hendryadrian.com
Vulnerability & Exploit · cyberscoop.com

SonicWall SMA1000 Zero-Days Exploited in the Wild, Vendor Urges Patching

· Original article ↗

Summary

SonicWall says attackers are exploiting CVE-2026-15409 and CVE-2026-15410 in SMA1000 appliances; Rapid7 observed activity from June 22. Chained flaws can enable full appliance compromise. Patches are available, and CISA added both to its exploited-vulnerability catalog.

Key points

  • SonicWall confirmed active exploitation of CVE-2026-15409 and CVE-2026-15410, which affect SMA1000 appliances.
  • Rapid7 said it observed the first known exploitation on June 22.
  • SonicWall confirmed the flaws have been chained; a VulnCheck researcher said the chain can take an attacker from no access to full appliance compromise.
  • Rapid7 said the observed activity likely aimed at ransomware, but its teams prevented the actors from achieving exfiltration and encryption in the cases it observed.
  • CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog.
  • SonicWall released fixes and urged customers to upgrade and check for indicators of compromise; it said patching alone may not be sufficient.

Article Details

Vulnerability Types
  • Command injection
Severity
One vulnerability is described as max-severity; the other is rated 7.2.
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationAttackers exploited the chained zero-days in SonicWall SMA1000 appliances; the article describes a plausible path to remote code execution from the internet.

CVE

CVE-2026-15409SonicWall · SMA1000SonicWall has confirmed that attackers are exploiting two zero-day vulnerabilities, CVE-2026-15409 and CVE-2026-15410, in SMA1000 appliances, with Rapid7 saying the first known exploitation occurred on June 22.CVE-2026-15410SonicWall · SMA1000SonicWall has confirmed that attackers are exploiting two zero-day vulnerabilities, CVE-2026-15409 and CVE-2026-15410, in SMA1000 appliances, with Rapid7 saying the first known exploitation occurred on June 22.

People

Ben HarriswatchTowr founder and CEO; commented that the zero-days were exploited before fixes were available and could provide a path to remote code execution from the internet.Bret FitzgeraldSonicWall senior director of global communications; described the company's response script and mitigation efforts for affected customers.Landon RiceVulnCheck senior exploit developer; said chaining the vulnerabilities could take an attacker from zero access to complete system compromise of an affected appliance.Seth LazarusRapid7 senior manager of detection and response services; said Rapid7 observed exploitation and that the likely goal was ransomware, while its team prevented exfiltration and encryption in the cases it observed.

Malware

AkiraTen of those defects are known to be used in ransomware campaigns, according to CISA, including a wave of about 40 Akira ransomware attacks between mid-July and early August.

Vendors

Rapid7SonicWall has confirmed that attackers are exploiting two zero-day vulnerabilities, CVE-2026-15409 and CVE-2026-15410, in SMA1000 appliances, with Rapid7 saying the first known exploitation occurred on June 22.SonicWallSonicWall has confirmed that attackers are exploiting two zero-day vulnerabilities, CVE-2026-15409 and CVE-2026-15410, in SMA1000 appliances, with Rapid7 saying the first known exploitation occurred on June 22.

Products

SMA1000SonicWall has confirmed that attackers are exploiting two zero-day vulnerabilities, CVE-2026-15409 and CVE-2026-15410, in SMA1000 appliances, with Rapid7 saying the first known exploitation occurred on June 22.

Related Articles