CISA ties two SMA1000 bugs to ransomware
CISA has marked CVE-2026-15409 and CVE-2026-15410 in SonicWall SMA1000 appliances as used in ransomware campaigns in its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-15409 is a maximum-severity server-side request forgery flaw that needs no login. CVE-2026-15410 is code injection: an authenticated administrator can use it to run OS commands.
CISA first added both to KEV on July 14 and gave federal civilian agencies three days to patch. By then SonicWall’s PSIRT was already investigating several cases of active exploitation. Its advisory still did not mention ransomware when BleepingComputer published.
An INC Ransomware affiliate and UTA0533
CISA did not name a group. Resecurity has linked the attacks to an INC Ransomware affiliate, and Volexity earlier reported that UTA0533 exploited the flaws from June 22, weeks before disclosure, and deployed KNUCKLEBALL, Suo5, ROOTRUN and ORANGETAIL on VPN appliances.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
More than 380 appliances still online
Large companies, government agencies and managed service providers use SMA1000 for VPN access to internal applications. Shadowserver tracks more than 380 SMA1000 appliances exposed online, though some may already be patched.
SMA1000 has been hit before. In December, SonicWall warned that CVE-2025-40602 in the Appliance Management Console was being chained in zero-day attacks to gain root.
Check hotfixes and sessions back to June 22
- Confirm every SMA1000 appliance runs SonicWall’s hotfix release, including standby and lab units.
- Appliances that were exposed before July 14 need a compromise review: look for the malware families above and for web shells.
- Rotate credentials that passed through the appliance and review VPN sessions from June 22 onward.
- Use SonicWall advisory SNWLID-2026-0008, which CISA links in the KEV entry, to confirm the fixed versions.
Source Context
Primary sources and original reporting:
- BleepingComputer: CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs
- CISA Known Exploited Vulnerabilities Catalog
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
