The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware groups are actively exploiting two recently patched vulnerabilities in SonicWall SMA1000 secure remote access gateways. These flaws, identified as CVE-2026-15409 and CVE-2026-15410, include a maximum-severity server-side request forgery (SSRF) vulnerability.
SonicWall SMA1000 devices are widely used by large corporations, government entities, and Managed Service Providers (MSPs) to provide VPN access to internal applications and corporate networks. SonicWall released hotfix patches for these vulnerabilities in mid-July, simultaneously issuing a warning that threat actors were already exploiting them in zero-day attacks. The company's Product Security Incident Response Team (PSIRT) stated it had investigated multiple cases indicating active exploitation and urged customers to upgrade immediately.
Incident response firm Volexity reported that a threat actor, tracked as UTA0533, began exploiting these vulnerabilities as early as June 22, weeks before SonicWall's public disclosure. This group was observed deploying custom malware, including KNUCKLEBALL, Sou5, ROOTRUN, and ORANGETAIL, on vulnerable VPN appliances.
CISA added both CVE-2026-15409 and CVE-2026-15410 to its Known Exploited Vulnerabilities (KEV) Catalog on July 14. Federal Civilian Executive Branch (FCEB) agencies were mandated to patch their systems within three days, with CISA emphasizing that such vulnerabilities are frequent attack vectors posing significant risks to federal enterprises.
While SonicWall has not yet publicly updated its original advisory to confirm ransomware activity, CISA's recent updates to the KEV Catalog specifically flag these two flaws as being exploited by ransomware gangs.
Internet security watchdog Shadowserver currently identifies over 380 SMA1000 appliances exposed online, though some of these may have already been secured.
This is not the first time SonicWall SMA1000 devices have been targeted. In December, the company warned customers to patch CVE-2025-40602, a vulnerability in the SMA1000 Appliance Management Console (AMC) that hackers were chaining in zero-day attacks to gain root privileges.
Additionally, in November, SonicWall attributed a September security breach, which exposed customers' firewall configuration backup files, to state-sponsored hackers. This followed researchers' warnings of over 100 SonicWall SSLVPN accounts being compromised using stolen credentials. In September, SonicWall also issued a firmware update to remove the OVERSTEP rootkit malware, which had been deployed in attacks targeting SMA 100 series devices.
