Skip to content
OriginalSign in
Image: SecurityWeek

SecurityWeekIonut Arghire

INC Ransomware exploits CVE-2026-15409, gains root on SonicWall

Part of the CVE-2026-15409 story · since 14 Jul

Quiet for 2 dayslast report 10 Nov20 articles9 outlets
14 Jul · CISA first25 Aug15 Sep6 OctNowThis article14th of 20
  • Tue 14 Jul, 20:17 UTC. CISA, first report. CISA Lists SonicWall SMA1000 SSRF Flaw in KEV, Urges Patch. Cites a CVE in CISA KEV.
  • Tue 14 Jul, 22:23 UTC. CISA. CISA KEV Catalog Highlights SonicWall SMA1000 Flaw CVE-2026-15409. Cites a CVE in CISA KEV.
  • Wed 15 Jul, 05:57 UTC. SecurityWeek, its first report on the story. SonicWall patches critical zero day flaws in SMA1000 appliances. Cites a CVE in CISA KEV.
  • Wed 15 Jul, 08:47 UTC. Security Affairs, its first report on the story. SonicWall Warns of Active Exploitation of SMA 1000 Zero Days. Cites a CVE in CISA KEV.
  • Wed 15 Jul, 11:36 UTC. Security Affairs. CISA Flags SonicWall SMA1000 and Microsoft Flaws in KEV Catalog. Cites a CVE in CISA KEV.
  • Wed 15 Jul, 18:04 UTC. Rapid7, its first report on the story. SonicWall SMA1000 flaws exploited, urgent patch advised. Cites a CVE in CISA KEV.
  • Wed 15 Jul, 19:20 UTC. SecurityOnline, its first report on the story. Microsoft, SonicWall bugs found; RabbitMQ patches auth flaws. Cites a CVE in CISA KEV.
  • Fri 17 Jul, 21:01 UTC. Dark Reading, its first report on the story. SonicWall CVE-2026-15409 flaw lets ransomware group hijack VPNs. Cites a CVE in CISA KEV.
  • Sun 19 Jul, 14:49 UTC. SecurityOnline. Zero day exploit targets SonicWall SMA 1000, installs malware. Cites a CVE in CISA KEV.
  • Mon 20 Jul, 07:40 UTC. Security Affairs. Zero day exploits hit SonicWall VPN, giving attackers root access. Cites a CVE in CISA KEV.
  • Mon 20 Jul, 14:51 UTC. SecurityWeek. SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch. Cites a CVE in CISA KEV.
  • Tue 21 Jul, 09:51 UTC. SOCRadar, its first report on the story. SonicWall SMA 1000 zero day used to spread KNUCKLEBALL. Cites a CVE in CISA KEV.
  • Mon 3 Aug, 03:01 UTC. SecurityOnline. SonicWall SMA Exploit Chain Now Fuels INC Ransomware Attacks. Cites a CVE in CISA KEV.
  • Mon 3 Aug, 11:01 UTC. SecurityWeek. INC Ransomware exploits CVE-2026-15409, gains root on SonicWall. Cites a CVE in CISA KEV. This article, 14th of 20.
  • Tue 4 Aug, 14:31 UTC. Security Affairs. INC Ransomware abuses CVE-2026-15409 in SonicWall, calls victims. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 07:13 UTC. SecurityOnline. SonicWall Flaw Exposed 160 Active Directory Domains to Attackers. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 07:48 UTC. Security Affairs. SonicWall VPN Flaw Exposed Credentials Across 250 Organisations. Cites a CVE in CISA KEV.
  • Mon 12 Oct, 11:30 UTC. The Hacker News, its first report on the story. Hackers Exploit Critical SonicWall SMA Flaw Within Days of Disclosure. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 18:36 UTC. The Hacker News. AI Agents Power Ransomware Affiliates’ Attacks on Edge Devices. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 09:00 UTC. Securelist, its first report on the story. Kaspersky says Qilin accounted for 15% of ransomware victims. Cites a CVE in CISA KEV.

The INC Ransomware group has been identified as the primary threat actor exploiting two significant vulnerabilities in SonicWall’s SMA1000 secure remote access appliances, designated as CVE-2026-15409 (CVSS 10) and CVE-2026-15410 (CVSS 7.2). These flaws allow unauthenticated remote attackers to gain root access via WebSocket tunnels. The vulnerabilities were publicly patched on July 14, 2026, after being exploited as zero-days since June 22, 2026.

Cybersecurity firms noted that threat actors leveraged these vulnerabilities to access internal networks and harvest credentials. Victims, including private and government organizations across multiple countries, have reported receiving unsolicited communications from individuals posing as ransomware negotiators. Security experts recommend urgent patching of affected systems and conducting thorough threat assessments.

How the story developed

All 20 articles
Quiet for 2 dayslast report 10 Nov20 articles9 outlets

20 articles from 9 outlets since 14 Jul. Quiet since 10 Nov. This was the 14th report, 20 days after the first.

Now14 Jul2531510 Sep12 Oct202626First reportCISA · 14 Jul, 20:17This article14th of 20 · day 20
  • Tue 14 Jul, 20:17 UTC. CISA, first report. CISA Lists SonicWall SMA1000 SSRF Flaw in KEV, Urges Patch. Cites a CVE in CISA KEV.
  • Tue 14 Jul, 22:23 UTC. CISA. CISA KEV Catalog Highlights SonicWall SMA1000 Flaw CVE-2026-15409. Cites a CVE in CISA KEV.
  • Wed 15 Jul, 05:57 UTC. SecurityWeek, its first report on the story. SonicWall patches critical zero day flaws in SMA1000 appliances. Cites a CVE in CISA KEV.
  • Wed 15 Jul, 08:47 UTC. Security Affairs, its first report on the story. SonicWall Warns of Active Exploitation of SMA 1000 Zero Days. Cites a CVE in CISA KEV.
  • Wed 15 Jul, 11:36 UTC. Security Affairs. CISA Flags SonicWall SMA1000 and Microsoft Flaws in KEV Catalog. Cites a CVE in CISA KEV.
  • Wed 15 Jul, 18:04 UTC. Rapid7, its first report on the story. SonicWall SMA1000 flaws exploited, urgent patch advised. Cites a CVE in CISA KEV.
  • Wed 15 Jul, 19:20 UTC. SecurityOnline, its first report on the story. Microsoft, SonicWall bugs found; RabbitMQ patches auth flaws. Cites a CVE in CISA KEV.
  • Fri 17 Jul, 21:01 UTC. Dark Reading, its first report on the story. SonicWall CVE-2026-15409 flaw lets ransomware group hijack VPNs. Cites a CVE in CISA KEV.
  • Sun 19 Jul, 14:49 UTC. SecurityOnline. Zero day exploit targets SonicWall SMA 1000, installs malware. Cites a CVE in CISA KEV.
  • Mon 20 Jul, 07:40 UTC. Security Affairs. Zero day exploits hit SonicWall VPN, giving attackers root access. Cites a CVE in CISA KEV.
  • Mon 20 Jul, 14:51 UTC. SecurityWeek. SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch. Cites a CVE in CISA KEV.
  • Tue 21 Jul, 09:51 UTC. SOCRadar, its first report on the story. SonicWall SMA 1000 zero day used to spread KNUCKLEBALL. Cites a CVE in CISA KEV.
  • Mon 3 Aug, 03:01 UTC. SecurityOnline. SonicWall SMA Exploit Chain Now Fuels INC Ransomware Attacks. Cites a CVE in CISA KEV.
  • Mon 3 Aug, 11:01 UTC. SecurityWeek. INC Ransomware exploits CVE-2026-15409, gains root on SonicWall. Cites a CVE in CISA KEV. This article, 14th of 20.
  • Tue 4 Aug, 14:31 UTC. Security Affairs. INC Ransomware abuses CVE-2026-15409 in SonicWall, calls victims. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 07:13 UTC. SecurityOnline. SonicWall Flaw Exposed 160 Active Directory Domains to Attackers. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 07:48 UTC. Security Affairs. SonicWall VPN Flaw Exposed Credentials Across 250 Organisations. Cites a CVE in CISA KEV.
  • Mon 12 Oct, 11:30 UTC. The Hacker News, its first report on the story. Hackers Exploit Critical SonicWall SMA Flaw Within Days of Disclosure. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 18:36 UTC. The Hacker News. AI Agents Power Ransomware Affiliates’ Attacks on Edge Devices. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 09:00 UTC. Securelist, its first report on the story. Kaspersky says Qilin accounted for 15% of ransomware victims. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 20 articles as a list
  1. Tue 14 JulDay 02
    1. CISA Lists SonicWall SMA1000 SSRF Flaw in KEV, Urges Patch20:17 · CISA · official · First report · CISA alert · Known exploited CVE
    2. CISA KEV Catalog Highlights SonicWall SMA1000 Flaw CVE-2026-1540922:23 · CISA · official · Known exploited CVE
  2. Wed 15 JulDay 15
    1. SonicWall patches critical zero day flaws in SMA1000 appliances05:57 · SecurityWeek · Known exploited CVE
    2. SonicWall Warns of Active Exploitation of SMA 1000 Zero Days08:47 · Security Affairs · Known exploited CVE
    3. CISA Flags SonicWall SMA1000 and Microsoft Flaws in KEV Catalog11:36 · Security Affairs · Known exploited CVE
    Show 2 more from 15 Jul
    1. SonicWall SMA1000 flaws exploited, urgent patch advised18:04 · Rapid7 · Known exploited CVE
    2. Microsoft, SonicWall bugs found; RabbitMQ patches auth flaws19:20 · SecurityOnline · Known exploited CVE

  3. Quiet for 2 days

    Fri 17 JulDay 31
    1. SonicWall CVE-2026-15409 flaw lets ransomware group hijack VPNs21:01 · Dark Reading · Picked up again · Known exploited CVE

  4. Quiet for 2 days

    Sun 19 JulDay 51
    1. Zero day exploit targets SonicWall SMA 1000, installs malware14:49 · SecurityOnline · Known exploited CVE
  5. Mon 20 JulDay 62
    1. Zero day exploits hit SonicWall VPN, giving attackers root access07:40 · Security Affairs · Known exploited CVE
    2. SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch14:51 · SecurityWeek · Known exploited CVE
  6. Tue 21 JulDay 71
    1. SonicWall SMA 1000 zero day used to spread KNUCKLEBALL09:51 · SOCRadar · Known exploited CVE

  7. Quiet for 13 days

    Mon 3 AugDay 202
    1. SonicWall SMA Exploit Chain Now Fuels INC Ransomware Attacks03:01 · SecurityOnline · Picked up again · Known exploited CVE
    2. INC Ransomware exploits CVE-2026-15409, gains root on SonicWall11:01 · SecurityWeek · Known exploited CVE · This article, 14th of 20
  8. Tue 4 AugDay 211
    1. INC Ransomware abuses CVE-2026-15409 in SonicWall, calls victims14:31 · Security Affairs · Known exploited CVE

  9. Quiet for 5 weeks

    Fri 11 SepDay 592
    1. SonicWall Flaw Exposed 160 Active Directory Domains to Attackers07:13 · SecurityOnline · Picked up again · Known exploited CVE
    2. SonicWall VPN Flaw Exposed Credentials Across 250 Organisations07:48 · Security Affairs · Known exploited CVE

  10. Quiet for 4 weeks

    Mon 12 OctDay 901
    1. Hackers Exploit Critical SonicWall SMA Flaw Within Days of Disclosure11:30 · The Hacker News · Picked up again · Known exploited CVE

  11. Quiet for 11 days

    Fri 23 OctDay 1011
    1. AI Agents Power Ransomware Affiliates’ Attacks on Edge Devices18:36 · The Hacker News · Picked up again · Known exploited CVE

  12. Quiet for 3 weeks

    Tue 10 NovDay 1191
    1. Kaspersky says Qilin accounted for 15% of ransomware victims09:00 · Securelist · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in