Dark ReadingNate Nelson
SonicWall CVE-2026-15409 flaw lets ransomware group hijack VPNs
On July 14, 2026, SonicWall disclosed two zero-day vulnerabilities in its Secure Mobile Access (SMA) appliances, CVE-2026-15409 and CVE-2026-15410. These vulnerabilities can be exploited by attackers to gain remote code execution (RCE) and elevate their access to root-level control. The vulnerabilities are actively being exploited by the Inc ransomware group, allowing them to infiltrate enterprise networks, steal credentials, and prepare for ransomware deployment.
CVE-2026-15409 is a server-side request forgery (SSRF) flaw that scores a maximum of 10 in severity, while CVE-2026-15410 is a code injection vulnerability scoring 7.2. SonicWall has issued a hotfix for these vulnerabilities and has encouraged customers to implement it promptly, highlighting the importance of swift action against potential security breaches.
AI summary of the original article from Dark Reading, written automatically by a language model. Quotes, figures and names come from that article; check it before relying on a detail. Read the original · How summaries are made
Story timeline CVE-2026-15409
Full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Fri 17 Jul · 21:01 UTC | Dark Reading | SonicWall CVE-2026-15409 flaw lets ransomware group hijack VPNs (this article) |
| Mon 3 Aug · 03:01 UTC | SecurityOnline | SonicWall SMA Exploit Chain Now Fuels INC Ransomware Attacks |
| Mon 3 Aug · 11:01 UTC | SecurityWeek | INC Ransomware exploits CVE-2026-15409, gains root on SonicWall |
| Tue 4 Aug · 14:31 UTC | Security Affairs | INC Ransomware abuses CVE-2026-15409 in SonicWall, calls victims |
| Fri 11 Sep · 07:13 UTC | SecurityOnline | SonicWall Flaw Exposed 160 Active Directory Domains to Attackers |
| Fri 11 Sep · 07:48 UTC | Security Affairs | SonicWall VPN Flaw Exposed Credentials Across 250 Organisations |
| Mon 12 Oct · 11:30 UTC | The Hacker News | Hackers Exploit Critical SonicWall SMA Flaw Within Days of Disclosure |
| Fri 23 Oct · 18:36 UTC | The Hacker News | AI Agents Power Ransomware Affiliates’ Attacks on Edge Devices |