CVE-2026-15409Active Exploitation(sonicwall / sma6210)

🚨 Two actively exploited zero-days affecting SonicWall SMA1000 appliances: CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410 (CVSS 7.2) I’ve created vulnerability detection templates here (with confidence levels): CVE-2026-15409: https://github.com/rxerium/rxerium-templates/blob/main/2026/CVE-2026-15409.yaml CVE-2026-15410: https://github.com/rxerium/rxerium-templates/blob/main/2026/CVE-2026-15410.yaml CVE-2026-15409 is remotely exploitable without authentication, while CVE-2026-15410 requires an authenticated administrator. Platform hotfixes are available through SonicWall’s security advisory: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008

PoC for the recent SonicWall SMA1000 0day, CVE-2026-15409, courtesy of @the_emmons 🔥 https://github.com/remmons-r7/rapid7-CVE-2026-15409 and check out the @rapid7 blog for technical details, observed exploitation and IOCs 🎯 https://www.rapid7.com/blog/post/etr-rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410/

🚨 CVE-2026-15409 (CVSS 10.0 unauth SSRF in SonicWall SMA1000) is being mass exploited Actors are exploiting the vulnerability on our SonicWall SMA honeypots and other targets using the @rapid7 PoC released yesterday, suggesting mass exploitation An unauthenticated attacker can execute code (non-root) via the wsproxy endpoint, then chain CVE-2026-15410 for root and full appliance compromise. Track SonicWall SMA exploitation live 👉 http://console.defusedcyber.com/signup

If you're looking into the newest SonicWall exploitation (CVE-2026-15409 & CVE-2026-15410), the Volexity blog is a must read: https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/

🚨 MASS EXPLOITATION OF SONICWALL SMA1000 — ATTACKERS PIVOTING DIRECTLY INTO ACTIVE DIRECTORY New research from http://Hunt.io has exposed a large-scale exploitation campaign targeting SonicWall SMA1000 appliances through the critical CVE-2026-15409 vulnerability. CVE-2026-15409: * CVSS: 10.0 — CRITICAL * Remote exploitation * No authentication required * SonicWall-confirmed active exploitation * CISA KEV-listed But the most important part is what attackers did AFTER compromising the appliance. The campaign data revealed: * 250 SonicWall targets processed * LDAP configurations recovered from 168 appliances * 534 configuration records exposed * 160 unique Active Directory domains affected * 255 internal LDAP servers identified * SAM/LSA secrets stolen from 9 AD environments * Full DCSync successful against 7 domain controllers across 5 environments * Confirmed credential theft in France, India, Italy and the United States The attacker wasn't simply compromising the VPN appliance. They turned the SonicWall device itself into an INTERNAL ATTACK PLATFORM. After exploiting CVE-2026-15409, the operator extracted policy_file.xml from compromised appliances and recovered stored LDAP configurations. The encrypted LDAP passwords were then decrypted using a static AES key identified in the appliance software. Then things escalated. Attackers deployed a standalone Linux build of Impacket's secretsdump DIRECTLY onto selected SonicWall appliances. The attack chain effectively became: Internet → SonicWall SMA1000 → CVE-2026-15409 → Command execution → LDAP configuration theft → LDAP password decryption → Internal Active Directory access → SAM/LSA credential dumping → DCSync → Entire AD credential database exposed In five environments, the attackers successfully performed full Active Directory replication through DCSync. 🚨 WEAPONIZATION WAS EXTREMELY FAST SonicWall disclosed CVE-2026-15409 on July 14. Rapid7 published a PoC on July 15. By July 16, the attacker had already modified the PoC into a 50-thread scanner capable of finding and exploiting vulnerable SMA1000 appliances at scale. http://Hunt.io also assesses with MODERATE CONFIDENCE that the July cyberattack against the Borough Council of King's Lynn and West Norfolk in the UK was connected to this campaign. ⚠️ Analyst Note: This campaign demonstrates one of the biggest visibility gaps in enterprise security. Organizations heavily monitor Windows endpoints with EDR. But what is monitoring the operating system underneath your: Firewall? VPN? Secure access gateway? Here, the attacker didn't need to immediately deploy tooling onto an EDR-protected Windows endpoint. They ran Impacket directly FROM THE SECURITY APPLIANCE. Edge-device compromise → Identity infrastructure compromise. Organizations operating SMA1000 appliances that were exposed during the exploitation window should not consider patching alone sufficient. Patch, investigate the appliance for compromise, and consider rotation of credentials stored or accessible through the device. Official SonicWall advisory: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008 #DDW #SonicWall #ActiveDirectory #CVE #CyberSecurity

‼️ CVE-2026-15409: PoC exploit for CVE-2026-15409 that achieves non-root remote code execution on SonicWall SMA 1000 appliances. GitHub: https://github.com/remmons-r7/rapid7-CVE-2026-15409 https://t.co/kaYWnMbNkH

Overnight our global honeypot network picked up broad scale exploitation of CVE-2026-15409 targeting SonicWall SMA1000 SSL-VPN appliances. The activity started at around 03:00 UTC and leveraged publicly available PoC code. If you have the appliance running and it is vulnerable - ensure you expedite patching, and review logs for signs of successful exploitation.

Explotan vulnerabilidad 0-day de SonicWall SMA1000 SonicWall ha revelado dos vulnerabilidades en sus dispositivos de acceso remoto SMA1000 Series CVE-2026-15409 CVE-2026-15410 https://blog.elhacker.net/2026/07/explotan-vulnerabilidad-0-day-de.html

Folks @HuntressLabs were in full swing this Friday analyzing the latest and greatest of CVE-2026-15409 and CVE-2026-15410, affecting SonicWall SMA 1000-series appliances. DCSync on the DC's, Sliver on the SMA's, and more below. Our first hint of adversarial access was remote registry dumping across numerous environments, detected and mitigated by Defender. This was Impacket's Secretsdump. https://github.com/fortra/impacket/blob/master/examples/secretsdump.py We began to analyze Huntress' SIEM data for signs of compromise from affected SMA devices within these environments. We found two distinct patterns. 1.) Adversaries acting to validate exploitation against these appliances from a variety of low rep providers. 2.) Anomalous curl activity from the 'root' user of an appliance; fetching payloads from 153.75.81[.]30. Two different payloads-- ".sshd" and ".rsyncd" were noted. They were stashed in /var/tmp/ and executed through cron (rsyncd-update and sshd-update) on the SMA appliance. Analysis of the payloads confirmed these were Sliver implants, an adversary emulation framework by BishopFox. These were configured to callback to the same staging IP. https://github.com/bishopfox/sliver This would allow an adversary to linger covertly after remediation efforts. Meanwhile, @xorJosh was busy cooking away on his own analysis-- and located an open directory containing CVE validation scripts (a CN-localized Rapid7 script), "autodcsync" and "autosecretsdump" Python files, and exfiltrated credentials from numerous environments. Of note, contained next to the credentials and scripts in the open dir was 'iox' and 'frp', two direct-tunnel tools. https://github.com/eddieivan01/iox https://github.com/fatedier/frp These are noteworty chiefly because they have been favorites of numerous nation-state APT groups. The key takeaways here are clear: - SIEM saves lives; make sure logs are being forwarded and retained. - Patching might not mean you're out of the woods, adversaries are already weaponizing persistent implants to maintain access. IOCs IPv4/Port: 153.75.81[.]30:30303 - Stager Resource: 153.75.81[.30:30303/a - .rsyncd Resource: 153.75.81[.30:30303/c - .sshd IPv4/Port: 153.75.81[.30:80 - Sliver C2 Callback Cron: /etc/cron.d/rsync-update - .rsyncd Cronjob Cron: /etc/cron.d/sshd-update - .sshd Cronjob Binary: 5aa0bb8a8a298fc00935dad22e73e1effc648b1739628b782727ba7bb123cbc3 (.rsyncd) Binary: 098db74319d0798291264c643522db59fc12d65ef649d7e12c7334ea75a74a4e (.sshd) Path: /var/tmp/.rsyncd Path: /var/tmp/.sshd

🚨 CVE-2026-15409: Critical Vulnerability Alert! SonicWall is affected by CVE-2026-15409. Full Vulnerability Details & Analysis at DarkEye: 🔗 https://darkeye.org/vuln/cve/CVE-2026-15409 🔍 Identify Targets via ZoomEye: Filter: vul.cve="CVE-2026-15409" Search Dork: app="SonicWall" Exposure: 2.5m instances identified globally. ZoomEye Search Link: 👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJTb25pY1dhbGwi&t=all&utm_source=twitter&utm_medium=social&utm_campaign=cve_ops_20260715 #Infosec #CyberSecurity #ZoomEye #DarkEye

⚠️⚠️ CVE-2026-15409 (CVSS 10.0): Unauthenticated SSRF on SonicWall SMA1000 Work Place — actively exploited in the wild. 🔗FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJTT05JQ1dBTEwtVmlydHVhbC1PZmZpY2Ui 🎯17.8K+ Results are found on http://en.fofa.info in the past year. FOFA Query: app="SONICWALL-Virtual-Office" 🔖Refer: https://securityonline.info/sonicwall-sma1000-ssrf/ #OSINT #FOFA #CyberSecurity #Vulnerability

🚨 On 7/14/26, #SonicWall published a security advisory on 2 vulns affecting SMA1000 Series remote access appliances – CVE-2026-15409 and CVE-2026-15410. Find mitigation guidance, IoC's and more in our blog: https://r-7.co/3RfzZ3i https://t.co/otRZw3iNiW

On July 17th, a UK council faced a cyber attack on election day A actor compromised 150+ Sonicwall devices via CVE-2026-15409, including the council, the same day. - Impacket binaries deployed to Sonicwall - Automated cred theft & DCSync from firewall @Huntio 👇

🚨 CVE-2026-15409 - critical 🚨 SonicWall SMA1000 - Server-Side Request Forgery > SMA1000 Appliance Work Place interface contains a server side request forgery caused ... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-15409 @pdnuclei #NucleiTemplates #cve

🚨 Two SonicWall SMA1000 vulnerabilities. One dangerous attack chain. Rapid Response test now available for CVE-2026-15409 + CVE-2026-15410. https://t.co/URCUE1lc9D

CVE-2026-15409 & CVE-2026-15410: Two exploited in the wild vulnerabilities in SonicWall SMA1000, up to 10.0 rating 🔥 Recently disclosed vulnerabilities in SonicWall SMA1000 allow an unauthenticated attacker to open a websocket-based tunnel to arbitrary localhost-only services and subsequently execute arbitrary operating system commands as root. These flaws are being actively exploited in the wild! PoC exists! 👉 https://nt.ls/I9q7F

SonicWall SMA 1000 zero-days are being chained. Internet-facing SSL VPN gateways. Active exploitation already underway. Two CVEs are at the centre of this. CVE-2026-15409 is an unauthenticated SSRF in the Workplace interface. CVE-2026-15410 is a code injection flaw in the Appliance Management Console. Neither is catastrophic alone. Chained together, attackers can compromise internet-facing SMA 1000 appliances without needing to start with valid credentials. That combination is what makes this move fast. SonicWall SMA appliances sit at the perimeter. They are the gateway into internal networks for remote access. Compromising one does not just give an attacker a foothold. It gives them the keys to everything that VPN is protecting. The failure mode here is familiar. VPN appliances get deployed, hardened once, and then treated as infrastructure rather than attack surface. Patches get deprioritised because downtime on a VPN gateway is disruptive. Monitoring for anomalous traffic through them is often minimal. Attackers know this. Perimeter appliances are high-value targets precisely because teams underinvest in their ongoing security posture. Patch SMA 1000 instances immediately. Segment what sits behind your VPN gateway. Monitor for unusual authentication patterns and unexpected lateral movement originating from VPN sessions. Set and forget is not a VPN security strategy. My name is Azubuike Ibe and I write about the perimeter gaps that attackers find before defenders remember to look. Patched your SonicWall SMA instances? Tell me where your team is on this. #Cybersecurity #SonicWall #VPN #ZeroDay #DevSecOps

米国CISAが悪用を確認した脆弱性 #KEV をカタログに追加しました。（7/14追加） 🛡CVE-2026-15409 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability ✅概要 ・深刻度：緊急 10.0 (CVSS Base) / CISA-ADP ・種別：サーバサイドのリクエストフォージェリ (CWE-918) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H SonicWall SMA1000 Appliance Work Place interface に存在する SSRF の脆弱性です。 未認証のリモート攻撃者が、対象アプライアンスに意図しない宛先へのリクエストを送信させる可能性があります。 ✅ChatGPTによる脆弱性評価 ・国内影響度：高 ・悪用難易度：低 ✅CISA 評価 ・攻撃自動化：自動化は可能 ・技術的影響：完全制御 ・BOD 26-04 対処期限（露出あり）：2026年7月17日 ・BOD 26-04 対処期限（露出なし）：2026年7月28日 ✅攻撃前提条件 ・SonicWall SMA1000 を使用している ・影響を受ける 12.4.3 系または 12.5.0 系ファームウェアを使用している ・攻撃者が SMA1000 Appliance Work Place interface へネットワーク経由でアクセスできる ・攻撃者は認証情報を必要としない ・修正済みホットフィックスバージョンへ更新されていない ✅悪用時影響 ・対象アプライアンスから意図しない宛先へリクエストを送信させられる可能性がある ・内部ネットワークや内部サービスへの到達確認に悪用される可能性がある ・SMA1000 アプライアンスを経由した追加侵害の足掛かりにされる可能性がある ・機密性、完全性、可用性に高い影響が生じる可能性がある ✅悪用事例等に関する公開情報 ・PoC/Exploit：公開情報確認できず ・ITW：確認済み（SonicWall） ・概要：SonicWall は、CVE-2026-15409 および CVE-2026-15410 が実際に悪用されていることを確認したと公表 ✅関連情報 ・https://nvd.nist.gov/vuln/detail/CVE-2026-15409 ・https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008 ・https://www.sonicwall.com/support/notices/product-notice-sma-1000-series-affected-by-multiple-vulnerabilities/kA1VN000001nv6D0AQ ・https://github.com/cisagov/vulnrichment/blob/develop/2026/15xxx/CVE-2026-15409.json ・https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409 🛡CVE-2026-15410 SonicWall SMA1000 Appliances Code Injection Vulnerability ✅概要 ・深刻度：重要 7.2 (CVSS Base) / CISA-ADP ・種別：コード・インジェクション (CWE-94) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H SonicWall SMA1000 Appliance Management Console に存在するコードインジェクションの脆弱性です。 特定条件下で、管理者として認証済みのリモート攻撃者が任意の OS コマンドを実行できる可能性があります。 ✅ChatGPTによる脆弱性評価 ・国内影響度：高 ・悪用難易度：中 ✅CISA 評価 ・攻撃自動化：自動化は困難 ・技術的影響：完全制御 ・BOD 26-04 対処期限（露出あり）：2026年7月17日 ・BOD 26-04 対処期限（露出なし）：2026年7月28日 ✅攻撃前提条件 ・SonicWall SMA1000 を使用している ・影響を受ける 12.4.3 系または 12.5.0 系ファームウェアを使用している ・攻撃者が SMA1000 Appliance Management Console へネットワーク経由でアクセスできる ・攻撃者が管理者権限の認証情報または管理者セッションを持っている ・修正済みホットフィックスバージョンへ更新されていない ✅悪用時影響 ・SMA1000 アプライアンス上で任意の OS コマンドを実行される可能性がある ・アプライアンスの設定を改ざんされる可能性がある ・認証情報や構成情報を窃取される可能性がある ・VPN ゲートウェイを起点に内部ネットワークへ追加侵害される可能性がある ・機密性、完全性、可用性に高い影響が生じる可能性がある ✅悪用事例等に関する公開情報 ・PoC/Exploit：公開情報確認できず ・ITW：確認済み（SonicWall） ・概要：SonicWall は、CVE-2026-15409 および CVE-2026-15410 が実際に悪用されていることを確認したと公表 ✅関連情報 ・https://nvd.nist.gov/vuln/detail/CVE-2026-15410 ・https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008 ・https://www.sonicwall.com/support/notices/product-notice-sma-1000-series-affected-by-multiple-vulnerabilities/kA1VN000001nv6D0AQ ・https://github.com/cisagov/vulnrichment/blob/develop/2026/15xxx/CVE-2026-15410.json ・https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15410 🛡CVE-2026-56155 Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability ✅概要 ・深刻度：重要 7.8 (CVSS Base) / Microsoft Corporation (CNA) ・種別：アクセス制御の不十分な粒度 (CWE-1220) ・CVSS:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Active Directory Federation Services に存在する、アクセス制御の粒度不足に起因する権限昇格の脆弱性です。 AD FS がトークン署名証明書およびトークン暗号化証明書の秘密鍵を保護するために使用する DKM コンテナの ACL が過度に許可されている場合、DKM キー素材へアクセス可能な攻撃者がトークン署名秘密鍵を復号できる可能性があります。 Microsoft は 2026年7月14日の Windows セキュリティ更新で、DKM コンテナ ACL の監査および段階的なハードニングを開始しています。 ✅ChatGPTによる脆弱性評価 ・国内影響度：高 ・悪用難易度：高 ✅CISA 評価 ・攻撃自動化：自動化は困難 ・技術的影響：完全制御 ・BOD 26-04 対処期限（露出あり）：2026年7月17日 ・BOD 26-04 対処期限（露出なし）：2026年7月28日 ✅攻撃前提条件 ・Active Directory Federation Services を使用している ・影響を受ける Windows Server または Windows Server Core 環境を使用している ・DKM コンテナの ACL が過度に許可された状態である ・攻撃者がローカルで低権限の権限を持っている ・攻撃者が DKM キー素材へ読み取りアクセスできる状態である ・2026年7月14日以降の Windows セキュリティ更新、または Microsoft の DKM ACL ハードニング手順が適用されていない ✅悪用時影響 ・DKM キー素材を読み取られる可能性がある ・トークン署名証明書の秘密鍵を復号される可能性がある ・AD FS のトークン署名機能を悪用される可能性がある ・認証基盤上で権限昇格につながる可能性がある ・フェデレーション認証環境におけるなりすましや不正アクセスにつながる可能性がある ✅悪用事例等に関する公開情報 ・PoC/Exploit：公開情報確認できず ・ITW：未確認 ✅関連情報 ・https://nvd.nist.gov/vuln/detail/CVE-2026-56155 ・https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155 ・https://support.microsoft.com/en-us/servicing/os/windows/docs/2026/07/kb5121391-cve-2026-56155-ad-fs-dkm-container-acl-hardening ・https://github.com/cisagov/vulnrichment/blob/develop/2026/56xxx/CVE-2026-56155.json ・https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56155 🛡CVE-2026-56164 Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability ✅概要 ・深刻度：緊急 9.8 (CVSS Base) / NVD、注意 5.3 (CVSS Base) / Microsoft Corporation (CNA) ・種別：重要な機能に対する認証の欠如 (CWE-306) ・CVSS:NVD=CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H / Microsoft Corporation (CNA)=CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Microsoft SharePoint Server に存在する、重要な機能に対する認証欠如の脆弱性です。 未認証の攻撃者がネットワーク経由で悪用することで、SharePoint Server 上で権限昇格できる可能性があります。 ✅ChatGPTによる脆弱性評価 ・国内影響度：高 ・悪用難易度：低 ✅CISA 評価 ・攻撃自動化：自動化は可能 ・技術的影響：部分的 ・BOD 26-04 対処期限（露出あり）：2026年7月17日 ・BOD 26-04 対処期限（露出なし）：2026年7月28日 ✅攻撃前提条件 ・Microsoft SharePoint Server を使用している ・Microsoft SharePoint Enterprise Server 2016 で 16.0.5561.1001 未満を使用している ・Microsoft SharePoint Server 2019 で 16.0.10417.20175 未満を使用している ・Microsoft SharePoint Server Subscription Edition で 16.0.19725.20434 未満を使用している ・攻撃者が対象 SharePoint Server へネットワーク経由でアクセスできる ・攻撃者は認証情報を必要としない ・修正済み更新プログラムが適用されていない ✅悪用時影響 ・未認証の攻撃者に権限昇格される可能性がある ・SharePoint Server 上の重要機能を不正に利用される可能性がある ・SharePoint 環境上の情報へ不正アクセスされる可能性がある ・他の SharePoint 脆弱性や侵害後活動と組み合わせて悪用される可能性がある ・オンプレミス SharePoint 環境を起点に追加侵害へつなげられる可能性がある ✅悪用事例等に関する公開情報 ・PoC/Exploit：一部公開（技術情報のみ） ・ITW：確認済み（CISA） ✅関連情報 ・https://nvd.nist.gov/vuln/detail/CVE-2026-56164 ・https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164 ・https://github.com/cisagov/vulnrichment/blob/develop/2026/56xxx/CVE-2026-56164.json ・https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56164 ・https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-adds-four-known-exploited-vulnerabilities-catalog #vulnerability

🕵️‍♂️ SonicWall SMA1000 (CVE-2026-15409): SSRF to Erlang RCE chained into automated DCSync from the appliance https://hunt.io/blog/sonicwall-sma1000-uk-council-attack

⚠️Alerte CERT-FR⚠️ Les vulnérabilités CVE-2026-15409 et CVE-2026-15410 affectent les SMA 1000 et permettent une SSRF ainsi que d'exécuter du code arbitraire à distance. Elles sont activement exploitées.