{"id":"sonicwall-sma1000-zero-days-exploited-jul-2026","category":"patch","status":"closed","title":"SonicWall SMA1000 appliances: two flaws (CVE-2026-15409, CVE-2026-15410) used in attacks, including by ransomware gangs; fixed","tldr":"SonicWall SMA1000 remote-access appliances (SMA6210, 7210, 8200v) had two flaws used together, from at least 22 June, to take full control. Fixes exist (12.4.3-03453, 12.5.0-02835). Patch, then check for compromise and reset credentials and MFA codes.","summary":"Two flaws in SonicWall's SMA1000 remote-access appliances (models SMA6210, SMA7210 and SMA8200v) have been used in real attacks. CVE-2026-15409, rated 10 out of 10, lets someone with no login make the appliance send requests to services inside the network behind it. CVE-2026-15410, rated 7.2, lets a person who already has administrator access run commands on the appliance. Volexity found the two being chained, with the earliest compromise on 22 June 2026, before SonicWall published its advisory on 14 July. SonicWall released fixed builds 12.4.3-03453 and 12.5.0-02835 and says patching alone is not enough: appliances may already be compromised. Rapid7 reported attackers taking credentials, session data and MFA seeds. CISA listed both flaws as used in attacks and flags ransomware use. Resecurity says INC ransomware became the main user of the chain, though it published no evidence tying INC to the intrusions. As of the latest report found, 1 August, no further fix has been issued.","action":"If your organisation or an IT provider runs a SonicWall SMA1000 (6210, 7210 or 8200v), ask them to install 12.4.3-03453 or 12.5.0-02835 or later now, check the logs for signs of compromise, and if any are found rebuild the appliance and reset all passwords and MFA codes. Nothing for home users to do.","product":"SonicWall SMA1000 series remote-access appliances (SMA6210, SMA7210, SMA8200v)","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-15409","CVE-2026-15410"],"tags":["sonicwall","sma1000","vpn","zero-day","ransomware","cisa-kev","inc-ransomware"],"affected":["SonicWall SMA6210, SMA7210 and SMA8200v (SMA1000 series), firmware builds 12.4.3-03245, 12.4.3-03387, 12.4.3-03434, 12.5.0-02283, 12.5.0-02624 and 12.5.0-02800"],"fixed":["12.4.3-03453","12.5.0-02835"],"matches":[],"sources":[{"kind":"advisory","title":"SonicWall security advisory SNWLID-2026-0008","url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008","by":"SonicWall PSIRT","date":"2026-07-14"},{"kind":"news","title":"SonicWall SMA attacks via CVE-2026-15409, CVE-2026-15410","url":"https://www.helpnetsecurity.com/2026/07/14/sonicwall-sma-attacks-via-cve-2026-15409-cve-2026-15410/","by":"Help Net Security","date":"2026-07-14"},{"kind":"news","title":"SonicWall SMA1000 flaws exploited as zero-days to push custom malware","url":"https://www.bleepingcomputer.com/news/security/sonicwall-sma1000-flaws-exploited-as-zero-days-to-push-custom-malware/","by":"BleepingComputer","date":"2026-07-20"},{"kind":"research","title":"From wsproxy to root: INC ransomware and the SonicWall SMA exploit chain","url":"https://www.resecurity.com/blog/article/from-wsproxy-to-root-inc-ransomware-and-sonicwall-sma-exploit-chain","by":"Resecurity","date":"2026-08-01"}],"started":"2026-07-14","closed":"2026-08-01","created":"2026-11-03T22:02:21.083Z","updated":"2026-11-03T22:02:21.083Z","cve_notes":[{"cve":"CVE-2026-15409","name":"Server-side request forgery in SonicWall SMA1000 Work Place","what":"A server-side request forgery flaw in the Work Place interface of SonicWall SMA1000 appliances that lets an attacker with no login make the appliance send requests to services inside the network behind it.","severity":"critical","cvss":10},{"cve":"CVE-2026-15410","name":"Code injection in SonicWall SMA1000 management console","what":"A code injection flaw in the SMA1000 Appliance Management Console that lets an attacker who already has administrator access run commands on the appliance's operating system.","severity":"high","cvss":7.2}],"timeline":[{"at":"2026-08-01","added":"2026-11-03T22:00:26.134Z","kind":"wider-attacks","text":"Resecurity reported that INC ransomware had become the main group using the two-flaw chain, and that INC's leak site listed new victims in several countries between 17 July and 1 August. It does not publish the evidence tying INC to these intrusions, and reports no fix beyond the July hotfixes.","url":"https://www.resecurity.com/blog/article/from-wsproxy-to-root-inc-ransomware-and-sonicwall-sma-exploit-chain","by":"Resecurity","patch":null},{"at":"2026-07-17","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"Volexity published its analysis of the attacks. BleepingComputer reported it on 20 July: the attacker used the two flaws together to get full control of the appliance and install custom tools, with limited success spreading further into victims' networks.","url":"https://www.bleepingcomputer.com/news/security/sonicwall-sma1000-flaws-exploited-as-zero-days-to-push-custom-malware/","by":"BleepingComputer","patch":null},{"at":"2026-07-16","added":"2026-11-03T22:00:26.134Z","kind":"wider-attacks","text":"Help Net Security reports that Rapid7 published its findings and a proof-of-concept for CVE-2026-15409. Rapid7 says its team saw attacks on internet-facing appliances before disclosure, with attackers taking credentials, session databases and one-time-code (TOTP) seeds.","url":"https://www.helpnetsecurity.com/2026/07/14/sonicwall-sma-attacks-via-cve-2026-15409-cve-2026-15410/","by":"Help Net Security","patch":null},{"at":"2026-07-14","added":"2026-11-03T22:00:26.134Z","kind":"cisa-added","text":"CISA added CVE-2026-15409 and CVE-2026-15410 to its list of flaws used in attacks, with a federal remediation deadline of 17 July. Help Net Security dates the listing 15 July; HARD's feed from CISA shows 14 July.","url":"https://www.helpnetsecurity.com/2026/07/14/sonicwall-sma-attacks-via-cve-2026-15409-cve-2026-15410/","by":"Help Net Security","patch":null},{"at":"2026-07-14","added":"2026-11-03T22:00:26.134Z","kind":"new-fix","text":"SonicWall published advisory SNWLID-2026-0008 with fixed hotfix builds 12.4.3-03453 and 12.5.0-02835 for the SMA6210, SMA7210 and SMA8200v. Customers could ask SonicWall Support for the fixes before they were posted publicly. SonicWall says patching alone is not enough and customers should check for signs of compromise.","url":"https://www.helpnetsecurity.com/2026/07/14/sonicwall-sma-attacks-via-cve-2026-15409-cve-2026-15410/","by":"Help Net Security","patch":"patched"},{"at":"2026-06-22","added":"2026-11-03T22:00:26.134Z","kind":"disclosed","text":"Volexity says the earliest compromise it saw of an SMA1000 appliance was on 22 June 2026, weeks before SonicWall disclosed the flaws. It tracks the attacker as UTA0533.","url":"https://www.bleepingcomputer.com/news/security/sonicwall-sma1000-flaws-exploited-as-zero-days-to-push-custom-malware/","by":"BleepingComputer","patch":"none"}],"url":"https://hard.fyi/live/sonicwall-sma1000-zero-days-exploited-jul-2026/","json":"https://hard.fyi/api/live?id=sonicwall-sma1000-zero-days-exploited-jul-2026"}