CISA Flags Two SonicWall SMA1000 Flaws as Exploited by Ransomware Gangs
Summary
CISA says ransomware gangs are exploiting patched SonicWall SMA1000 flaws CVE-2026-15409 and CVE-2026-15410. Volexity linked earlier zero-day exploitation to UTA0533, which deployed four malware families.
Key points
- CISA flagged CVE-2026-15409 and CVE-2026-15410 as exploited by ransomware gangs and added both to its KEV Catalog.
- CVE-2026-15409 is a maximum-severity server-side request forgery (SSRF) flaw.
- SonicWall released patches in mid-July and had earlier warned of active zero-day exploitation.
- Volexity reported that UTA0533 began exploiting the flaws as early as June 22 to deploy KNUCKLEBALL, Sou5, ROOTRUN, and ORANGETAIL.
- CISA directed federal civilian agencies to patch within three days.
- Shadowserver tracked more than 380 SMA1000 appliances exposed online; some may already have been secured.
Article Details
- Vulnerability Types
- Server-side request forgery (SSRF)
- Severity
- CVE-2026-15409 is described as maximum-severity; severity for CVE-2026-15410 is not stated.
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
Threat Actors
Malware
KNUCKLEBALLThe issues were previously used in zero-day attacks by UTA0533 to deploy KNUCKLEBALL, Sou5, ROOTRUN, and ORANGETAIL against exposed SMA1000 appliances.OrangeTailThe issues were previously used in zero-day attacks by UTA0533 to deploy KNUCKLEBALL, Sou5, ROOTRUN, and ORANGETAIL against exposed SMA1000 appliances.RootRunThe issues were previously used in zero-day attacks by UTA0533 to deploy KNUCKLEBALL, Sou5, ROOTRUN, and ORANGETAIL against exposed SMA1000 appliances.Sou5The issues were previously used in zero-day attacks by UTA0533 to deploy KNUCKLEBALL, Sou5, ROOTRUN, and ORANGETAIL against exposed SMA1000 appliances.