SecurityWeekEduard Kovacs
SonicWall patches critical zero day flaws in SMA1000 appliances
SonicWall has issued an urgent update for its SMA1000 secure remote access appliances due to two critical zero-day vulnerabilities: CVE-2026-15409, a server-side request forgery (SSRF) exploit, and CVE-2026-15410, a code injection issue. These vulnerabilities affect versions 6210, 7210, and 8200v of these appliances, prompting users to apply hotfixes 12.4.3-03453 or 12.5.0-02835. Both vulnerabilities have been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, highlighting their active exploitation.
SonicWall has collaborated with Volexity during the investigation, but additional details about the attackers remain unclear.
Story timeline CVE-2026-15409
Full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 15 Jul · 05:57 UTC | SecurityWeek | SonicWall patches critical zero day flaws in SMA1000 appliances (this article) |
| Mon 3 Aug · 03:01 UTC | SecurityOnline | SonicWall SMA Exploit Chain Now Fuels INC Ransomware Attacks |
| Mon 3 Aug · 11:01 UTC | SecurityWeek | INC Ransomware exploits CVE-2026-15409, gains root on SonicWall |
| Tue 4 Aug · 14:31 UTC | Security Affairs | INC Ransomware abuses CVE-2026-15409 in SonicWall, calls victims |
| Fri 11 Sep · 07:13 UTC | SecurityOnline | SonicWall Flaw Exposed 160 Active Directory Domains to Attackers |
| Fri 11 Sep · 07:48 UTC | Security Affairs | SonicWall VPN Flaw Exposed Credentials Across 250 Organisations |
| Mon 12 Oct · 11:30 UTC | The Hacker News | Hackers Exploit Critical SonicWall SMA Flaw Within Days of Disclosure |
| Fri 23 Oct · 18:36 UTC | The Hacker News | AI Agents Power Ransomware Affiliates’ Attacks on Edge Devices |