Overview
- SonicWall issued hotfixes for CVE-2026-15409 and CVE-2026-15410 on July 14 and CISA added both to its Known Exploited Vulnerabilities catalog that same day.
- Security firms report the flaws were used as zero-days starting in late June to open WebSocket tunnels and escalate to root on SMA1000 appliances.
- INC Ransomware has become the most visible actor using the exploit chain, publishing multiple victims on a data-leak site and employing follow-up phone calls and emails as pressure tactics.
- Attackers use compromised appliances to harvest high-value credentials, active session stores and TOTP MFA seeds, deploy backdoors and HTTP proxies (examples include KNUCKLEBALL, Suo5 and ORANGETAIL), and attempt lateral movement into internal networks.
- Defenders are urged to apply SonicWall’s July fixes immediately, hunt for implants and filesystem artifacts, rotate credentials and reset MFA seeds, and reimage or replace appliances when compromise is suspected because patches may not remove active intrusions.