SonicWall SMA1000 appliances: two flaws (CVE-2026-15409, CVE-2026-15410) used in attacks, including by ransomware gangs; fixed
SonicWall SMA1000 remote-access appliances (SMA6210, 7210, 8200v) had two flaws used together, from at least 22 June, to take full control. Fixes exist (12.4.3-03453, 12.5.0-02835). Patch, then check for compromise and reset credentials and MFA codes.
If your organisation or an IT provider runs a SonicWall SMA1000 (6210, 7210 or 8200v), ask them to install 12.4.3-03453 or 12.5.0-02835 or later now, check the logs for signs of compromise, and if any are found rebuild the appliance and reset all passwords and MFA codes. Nothing for home users to do.
What’s happening
Two flaws in SonicWall's SMA1000 remote-access appliances (models SMA6210, SMA7210 and SMA8200v) have been used in real attacks. CVE-2026-15409, rated 10 out of 10, lets someone with no login make the appliance send requests to services inside the network behind it. CVE-2026-15410, rated 7.2, lets a person who already has administrator access run commands on the appliance. Volexity found the two being chained, with the earliest compromise on 22 June 2026, before SonicWall published its advisory on 14 July. SonicWall released fixed builds 12.4.3-03453 and 12.5.0-02835 and says patching alone is not enough: appliances may already be compromised. Rapid7 reported attackers taking credentials, session data and MFA seeds. CISA listed both flaws as used in attacks and flags ransomware use. Resecurity says INC ransomware became the main user of the chain, though it published no evidence tying INC to the intrusions. As of the latest report found, 1 August, no further fix has been issued.
- What
- Flaw
- Affects
- SonicWall SMA1000 series remote-access appliances (SMA6210, SMA7210, SMA8200v)
- Affected
- SonicWall SMA6210, SMA7210 and SMA8200v (SMA1000 series), firmware builds 12.4.3-03245, 12.4.3-03387, 12.4.3-03434, 12.5.0-02283, 12.5.0-02624 and 12.5.0-02800
- Fixed in
- 12.4.3-03453
12.5.0-02835 - Since
- 14 July 2026
- Closed
- 1 Aug 2026
Timeline
- Wider attacks
Resecurity reported that INC ransomware had become the main group using the two-flaw chain, and that INC's leak site listed new victims in several countries between 17 July and 1 August. It does not publish the evidence tying INC to these intrusions, and reports no fix beyond the July hotfixes.
- Update
Volexity published its analysis of the attacks. BleepingComputer reported it on 20 July: the attacker used the two flaws together to get full control of the appliance and install custom tools, with limited success spreading further into victims' networks.
- Wider attacks
Help Net Security reports that Rapid7 published its findings and a proof-of-concept for CVE-2026-15409. Rapid7 says its team saw attacks on internet-facing appliances before disclosure, with attackers taking credentials, session databases and one-time-code (TOTP) seeds.
- CISA added
CISA added CVE-2026-15409 and CVE-2026-15410 to its list of flaws used in attacks, with a federal remediation deadline of 17 July. Help Net Security dates the listing 15 July; HARD's feed from CISA shows 14 July.
- New fixFixed
SonicWall published advisory SNWLID-2026-0008 with fixed hotfix builds 12.4.3-03453 and 12.5.0-02835 for the SMA6210, SMA7210 and SMA8200v. Customers could ask SonicWall Support for the fixes before they were posted publicly. SonicWall says patching alone is not enough and customers should check for signs of compromise.
- Made publicNo fix yet
Volexity says the earliest compromise it saw of an SMA1000 appliance was on 22 June 2026, weeks before SonicWall disclosed the flaws. It tracks the attacker as UTA0533.
Sources
- SonicWall security advisory SNWLID-2026-0008SonicWall PSIRT · 14 July 2026
- SonicWall SMA attacks via CVE-2026-15409, CVE-2026-15410Help Net Security · 14 July 2026
- SonicWall SMA1000 flaws exploited as zero-days to push custom malwareBleepingComputer · 20 July 2026
- From wsproxy to root: INC ransomware and the SonicWall SMA exploit chainResecurity · 1 Aug 2026