Two newly reported vulnerabilities in SonicWall’s Secure Mobile Access (SMA) appliances have been exploited as zero-days by a major ransomware group.
On July 14, the cybersecurity vendor SonicWall published a security advisory regarding two vulnerabilities in its SMA 1000 Series appliances, CVE-2026-15409 and CVE-2026-15410. Together they could allow any random, unauthenticated attacker to gain remote code execution (RCE) powers and then run commands on the box at the root level.
Indeed, this is already happening. According to telemetry from Rapid7, a threat actor connected to the infamous Inc ransomware-as-a-service (RaaS) group has been using CVE-2026-15409 and CVE-2026-15410 as zero-days, burrowing into multiple enterprise networks, sweeping up credentials, and setting the stage for ransomware deployment.
Vulnerabilities in SonicWall SMAs
If you had to pick between the two flaws, CVE-2026-15409 should warrant special concern. It’s a server-side request forgery (SSRF) issue in the SMA’s “Work Place” Web interface, which allows passersby on the Internet to craft Web requests that trick the portal into making requests on their behalf to internal and otherwise gated-off services. It requires no authentication, and it has earned a maximum 10 out of 10 score in the Common Vulnerability Scoring System (CVSS).
CVE-2026-15410 earned a lesser but still high 7.2 out of 10 CVSS score, since it requires that an attacker already be able to reach the Appliance Management Console (AMC) — the administrative user interface (UI) for an already accessible device. If they are, they can use this code injection vulnerability to execute arbitrary operating system (OS)-level commands.
The two vulnerabilities are probably most powerful in combination. SonicWall didn’t describe how exactly attackers have been chaining them. But according to Rapid7, attackers can exploit CVE-2026-15409 to establish code execution and then pivot to CVE-2026-15410 in order to complete the escalation from unauthenticated outsider to root-level insider. The researchers published a proof-of-concept (PoC) exploit for the former vulnerability on GitHub.
Connection to Inc Ransomware
The Cybersecurity and Infrastructure Security Agency’s (CISA) added CVE-2026-15409 and CVE-2026-15410 to its Known Exploited Vulnerabilities (KEV) catalog on July 14.
On July 15, Rapid7 provided more specific details. According to its telemetry, some unidentified threat actors were performing a textbook intrusion flow: using the appliances as an initial access vector, exploiting the vulnerabilities to bypass input validation controls and execute commands at the OS level. Having gained a foothold, they were establishing persistent access by stealing credentials, active session databases, and the seeds used to generate one-time login codes. Next, they were performing lateral movement from compromised SMAs across corporate networks, most notably targeting domain controllers.
Two days later, Rapid7 specifically attributed this activity to Inc ransomware. Brett Deroche, director of incident response at Rapid7, tells Dark Reading, “We have successfully prevented exfiltration and encryption in the majority of cases; however, we now have an active case in which ransomware deployment was achieved.”
He adds that, in stories like this, “It is vital to recognize that compromising an edge device is rarely the adversary’s ultimate destination. It is merely the foothold. The true objective remains exactly what it has always been: monetization. In recent history, this has been overwhelmingly achieved through double-extortion ransomware schemes that target both data exfiltration and encryption.”
SonicWall’s Woes
From a threat actor standpoint, the value of a SonicWall SMA 1000 Series appliance couldn’t be more straightforward. By compromising an organization’s gateway between the outside Web and its internal network, attackers can get access to sensitive systems and data, create their own accounts, and maybe drop their own code, among other malicious actions.
Additionally, SonicWall markets its SMA products as high-end security solutions for government agencies, managed security service providers (MSSPs), and medium to multinational enterprises. Thus, potential victims are also of more than average value. All this might help explain why hackers continually go after SonicWall, exploiting zero-day vulnerabilities in its products at a rate similar to other edge devices vendors, like Fortinet and Ivanti.
The company’s approach to vulnerability disclosure and remediation has also been the subject of debate, thanks to one customer, a Texas-based software-as-a-service (SaaS) company called Marquis Software Solutions. Earlier in 2026, Marquis sued SonicWall for failing to promptly and accurately inform it of a SonicWall cyberattack campaign that ended up enabling a ransomware attack against Marquis.
Thankfully, SonicWall addressed CVE-2026-15409 and CVE-2026-15410 this week with a new hotfix, which it strongly encourages customers to implement.
Still, “Patching after a public notice leaves a massive window of vulnerability where attackers are already acting on zero-days,” notes John Gallagher, vice president at Viakoo. “To compensate, organizations must treat edge and network-adjacent appliances with an assume-breach mentality, and roll out security updates at scale within minutes to hours, not weeks to months.”
More than patching itself, organizations need to put extra effort into identifying possible intrusions and acting swiftly to boot out persistent attackers.
“Simply applying the vendor patch is no longer sufficient if the appliance was already compromised,” Rapid7’s Deroche emphasizes. He’s seen cases where SonicWall customers have patched, but haven’t performed full forensic reviews immediately afterward and, as a result, “We observed the threat actor maintaining persistence and rolling the newly applied patch back to a vulnerable state to maintain access. A comprehensive forensic review of the firewall is required to ensure complete eviction.”
Dark Reading contacted SonicWall for comment.
