CVE-2026-15410 and CVE-2026-15409: SonicWall SMA 1000 Zero-Days Exploited in the Wild
July 16, 2026 · SOCPrime · Severity: CRITICAL
The INC Ransomware operation has emerged as the "dominant threat actor" exploiting the recently disclosed security flaws in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances. In a report published over the weekend, Resecurity said it observed the INC Ransomware accelerating its activity since the beginning of August 2026, listing multiple victims on its data leak site. Per statistics listed on Ransomware.Live, the group has claimed 885 victims to date, with the most recent victim listed on August 2, 2026. The attacks are suspected to involve the exploitation of CVE-2026-15409 and CVE-2026-15410 , which could be chained to facilitate arbitrary command execution and take over susceptible devices. Fixes for the vulnerability pair were released by SonicWall in mid-July 2026. The two shortcomings are assessed to have been weaponized as zero-days, with Rapid7 noting that the attacks leveraged the foothold to extract high-value credentials, active session databases, and Time-Based One-Time Password (TOTP) multi-factor authentication (MFA) seed configurations with an aim to ensure long-term, persistent access and ultimately carry out lateral movement into the internal corporate network. In a follow-up report, Volexity attributed the pre-disclosure exploitation starting June 22, 2026, to a threat cluster it tracks as UTA0533. The attacks involve the deployment of a Python script named KNUCKLEBALL that's used to launch Suo5, an open-source HTTP proxy, and a Behinder-like custom Java web shell dubbed ORANGETAIL. Rapid7 subsequently told The Hacker News that the campaign shares significant tactical overlaps with its own investigations. "This strong technical correlation indicates that a single threat actor or coordinated group is responsible for discovering and exploiting this zero-day vulnerability," Douglas McKee, director of vulnerability intelligence at Rapid7, said.
SonicWall has patched two actively exploited zero-days affecting SMA 1000 Series secure remote access appliances. The issues are CVE-2026-15409, a critical unauthenticated SSRF flaw in the Workplace interface, and CVE-2026-15410, a post-authentication code injection flaw in the Appliance Management Console that can lead to arbitrary OS command execution as administrator under certain conditions. Public reporting says the vulnerabilities have been exploited together in real attacks against SMA6210, SMA7210, and SMA8200v appliances.
The most important details for CVE-2026-15409 are that it provides the pre-authentication foothold, while CVE-2026-15410 is used after privileged access is obtained to deepen control over the appliance. SonicWall says affected firmware lines include 12.4.3-03245 / 03387 / 03434 and 12.5.0-02283 / 02624 / 02800, with fixes released in 12.4.3-03453+ and 12.5.0-02835+.
CVE-2026-15410 and CVE-2026-15409 analysis
From a tradecraft perspective, the two bugs serve different roles in the intrusion chain. CVE-2026-15409 affects the Appliance Workplace interface and allows a remote unauthenticated attacker to force the device to make requests to unintended locations. CVE-2026-15410 then targets the Appliance Management Console and may allow a remote attacker authenticated as an admin to execute arbitrary operating system commands. In observed attacks, public reporting says the flaws were chained together rather than used in isolation.
The operational impact goes beyond initial appliance compromise. Help Net Security reports that attackers who exploited the flaws extracted high-value credentials, active session databases, and TOTP multi-factor authentication seed configurations, then used the appliance as a stealthy foothold for further movement. The same reporting also cites Rapid7 observations of anomalous, VPN-less Active Directory authentications originating from the compromised SMA appliance’s internal IP address, indicating the device had become an unmonitored backdoor into directory infrastructure.
At the time of reporting, public exploitation maturity was already high. Help Net Security says Rapid7 released a CVE-2026-15409 PoC for exposure validation, while SonicWall and both news reports confirmed in-the-wild exploitation and noted that CISA added the two flaws to its Known Exploited Vulnerabilities catalog.
CVE-2026-15410 and CVE-2026-15409 Mitigation
SonicWall has made clear that patching alone is not enough. The vendor recommends upgrading immediately, but also reviewing appliances for compromise and, if indicators are present, re-imaging physical appliances or redeploying virtual appliances, changing user and administrator passwords, and resetting TOTP tokens. That guidance reflects the fact that attackers may already have established persistence or harvested authentication material before defenders apply the fixed firmware.
Practical CVE-2026-15409 detection should start with SonicWall’s published log and filesystem indicators. The most notable CVE-2026-15409 IOCs in public reporting include requests in extraweb_access.log to /__api__/login or /__api__/logout returning HTTP 200, requests to /wsproxy with suspicious host parameters returning HTTP 101, entries in ctrl-service.log showing hotfix rollbacks with path-traversal-style names, and unexpected /__api__/login or /__api__/logout routes inside /var/lib/unit/conf.json.
To Detect CVE-2026-15409 exposure and post-exploitation activity, defenders should combine firmware validation with forensic review of those artifacts and appliance access patterns. Because SonicWall says the two flaws were actively exploited and not unique to its platform, organizations running internet-facing SMA 1000 devices should treat suspicious access, altered routing entries, or rollback artifacts as potential signs of full appliance compromise rather than simple failed exploit attempts.
Disclaimer: Detection content may not be available for every CVE. Check the SOC Prime Platform for current coverage. If you don’t find relevant detections now, please check back later.
FAQ
What are CVE-2026-15410 and CVE-2026-15409 and how do they work?
CVE-2026-15409 is a critical SSRF flaw in the SonicWall SMA 1000 Workplace interface that can be exploited remotely without authentication to make the appliance send requests to unintended locations. CVE-2026-15410 is a post-authentication code injection flaw in the Appliance Management Console that can allow an authenticated admin-level attacker to execute arbitrary operating system commands. Public reporting says the two bugs have been used together in real attacks.
When were CVE-2026-15410 and CVE-2026-15409 first discovered?
The public reports do not disclose a private discovery date. What is confirmed is that SonicWall publicly disclosed the issues and their fixes in mid-July 2026, and credited Adam Babis of SonicWall PSIRT with discovering and reporting the flaws. SonicWall later also credited Sean Koessel and Steven Adair of Volexity for helping expand the investigation and the IOC list.
What is the impact of CVE-2026-15410 and CVE-2026-15409 on systems?
The combined impact can be severe. Public reporting says exploitation can lead to unauthorized requests from the appliance, arbitrary command execution as administrator, theft of credentials and session data, exposure of TOTP seed configurations, and follow-on movement into internal infrastructure using the compromised appliance as a backdoor.
Can CVE-2026-15410 and CVE-2026-15409 still affect me in 2026?
Yes. Organizations can still be exposed in 2026 if they continue to run affected SMA 1000 firmware versions or if their appliances were compromised before patching and were not forensically reviewed and rebuilt where needed. Both flaws were added to CISA’s KEV catalog, underscoring the urgency.
How can I protect myself from CVE-2026-15410 and CVE-2026-15409?
Upgrade immediately to the fixed SonicWall hotfix versions, review logs and configuration artifacts for the published indicators, and if compromise is suspected, re-image or redeploy the appliance, rotate passwords, and reset TOTP tokens. SonicWall’s own guidance stresses that remediation should include both patching and compromise assessment.
The post CVE-2026-15410 and CVE-2026-15409: SonicWall SMA 1000 Zero-Days Exploited in the Wild appeared first on SOC Prime.
Key Takeaways
- SonicWall has patched two actively exploited zero-days affecting SMA 1000 Series secure remote access appliances.
- Public reporting says the vulnerabilities have been exploited together in real attacks against SMA6210, SMA7210, and SMA8200v appliances.