CVE-2026-15410Active Exploitation(sonicwall / sma6210)

CRITICALCVSS 7.2 · HIGHCISA KEV

Exploitation observed; activity peaked at 34 mentions and remains active

Immediate actions

Patch sonicwall sma6210 systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.

sonicwall CVEs Back to dashboard

9.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-07-17. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Vendor / third-party advisories

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15410

Weakness type (CWE)

CWE-94

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

sma6210
sma6210_firmware
sma7210
sma7210_firmware

Threat summary

Active exploitation appears in 117 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
141 mentions across 28 observed days

What's happening

Active exploitation reported across 117 signals
Exploit tool or code specified in 11 signals
PoC mentioned or linked in 18 signals
Patch or workaround mentioned in 74 signals
Technical details provided in 87 signals
General: 11 classified signals
Peaked 26d ago at 34 mentions (2026-07-15); latest day: 1
141 total mentions across 28 days

Affected systems

Vendors

sonicwall

Products

sma6210sma6210_firmwaresma7210sma7210_firmwaresma8200v

7 versions affected across 5 products

Deep dive

Activity timeline141 mentions / 28d

Signal classification6 categories

Active Exploitation

10775.9%

Patch

128.5%

General

117.8%

Disclosure

75.0%

Exploit

32.1%

PoC

10.7%

Referenced assets106 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-14	11	Active Exploitation10Patch1
2026-07-15	34	Active Exploitation26Disclosure2General1Patch5
2026-07-16	10	Active Exploitation7Disclosure1Exploit1Patch1
2026-07-17	18	Active Exploitation8Disclosure1Exploit1General5Patch2PoC1
2026-07-18	7	Active Exploitation6Exploit1
2026-07-19	1	Patch1
2026-07-20	13	Active Exploitation12General1
2026-07-21	14	Active Exploitation12Disclosure1General1
2026-07-22	4	Active Exploitation2General2
2026-07-23	1	Active Exploitation1
2026-07-24	1	Patch1
2026-07-26	1	Active Exploitation1
2026-07-27	2	Active Exploitation1Disclosure1
2026-07-28	1	Active Exploitation1
2026-07-30	1	Active Exploitation1
2026-08-01	1	Active Exploitation1
2026-08-03	4	Active Exploitation4
2026-08-04	2	Active Exploitation2
2026-08-05	1	Active Exploitation1
2026-08-06	1	Active Exploitation1
2026-08-07	2	Active Exploitation2
2026-08-08	1	Active Exploitation1
2026-08-10	1	Active Exploitation1
2026-08-11	3	Active Exploitation2Patch1
2026-08-12	3	Active Exploitation1Disclosure1General1
2026-08-17	1	Active Exploitation1
2026-08-24	1	Active Exploitation1
2026-09-25	1	Active Exploitation1

Full discourse20 posts

Rishi@rxerium91d
Active Exploitation
🚨 Two actively exploited zero-days affecting SonicWall SMA1000 appliances: CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410 (CVSS 7.2) I’ve created vulnerability detection templates here (with confidence levels): CVE-2026-15409: https://github.com/rxerium/rxerium-templates/blob/main/2026/CVE-2026-15409.yaml CVE-2026-15410: https://github.com/rxerium/rxerium-templates/blob/main/2026/CVE-2026-15410.yaml CVE-2026-15409 is remotely exploitable without authentication, while CVE-2026-15410 requires an authenticated administrator. Platform hotfixes are available through SonicWall’s security advisory: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008
Post summary
This post announces that two zero‑day CVEs (CVE‑2026‑15409 and CVE‑2026‑15410) are actively exploited against SonicWall SMA1000 appliances, provides detection templates and notes that hotfixes are available.
24601958313.0K
3.8K followersView on X
Stephen Fewer@stephenfewer90d
Exploit
PoC for the recent SonicWall SMA1000 0day, CVE-2026-15409, courtesy of @the_emmons 🔥 https://github.com/remmons-r7/rapid7-CVE-2026-15409 and check out the @rapid7 blog for technical details, observed exploitation and IOCs 🎯 https://www.rapid7.com/blog/post/etr-rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410/
Post summary
The post announces a proof‑of‑concept and functional exploit code for CVE‑2026‑15409, highlights that the vulnerability is currently being exploited in the wild, and shares IOCs via a Rapid7 blog.
1340101368.1K
10.0K followersView on X
Defused@DefusedCyber90d
Active Exploitation
🚨 CVE-2026-15409 (CVSS 10.0 unauth SSRF in SonicWall SMA1000) is being mass exploited Actors are exploiting the vulnerability on our SonicWall SMA honeypots and other targets using the @rapid7 PoC released yesterday, suggesting mass exploitation An unauthenticated attacker can execute code (non-root) via the wsproxy endpoint, then chain CVE-2026-15410 for root and full appliance compromise. Track SonicWall SMA exploitation live 👉 http://console.defusedcyber.com/signup
Post summary
CVE-2026-15409 is currently being mass exploited in the wild using a Rapid7‑published PoC; attackers leverage the wsproxy SSRF to execute code and chain into CVE-2026-15410 to achieve root and full appliance compromise.
023162268.9K
7.7K followersView on X
tlansec@tlansec86d
General
If you're looking into the newest SonicWall exploitation (CVE-2026-15409 & CVE-2026-15410), the Volexity blog is a must read: https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/
Post summary
The post simply directs readers to a Volexity blog about SonicWall CVE-2026-15409 and CVE-2026-15410, lacking further technical detail or actionable information.
023057237.4K
2.9K followersView on X
elhacker.NET@elhackernet88d
Active Exploitation
Explotan vulnerabilidad 0-day de SonicWall SMA1000 SonicWall ha revelado dos vulnerabilidades en sus dispositivos de acceso remoto SMA1000 Series CVE-2026-15409 CVE-2026-15410 https://blog.elhacker.net/2026/07/explotan-vulnerabilidad-0-day-de.html
Post summary
SonicWall’s two 0‑day CVEs (CVE-2026-15409, CVE-2026-15410) for the SMA1000 Series are reported as being actively exploited, with a blog link presumably containing PoC details.
11103793.9K
141.7K followersView on X
Rem@sudo_Rem88d
Exploit
Folks @HuntressLabs were in full swing this Friday analyzing the latest and greatest of CVE-2026-15409 and CVE-2026-15410, affecting SonicWall SMA 1000-series appliances. DCSync on the DC's, Sliver on the SMA's, and more below. Our first hint of adversarial access was remote registry dumping across numerous environments, detected and mitigated by Defender. This was Impacket's Secretsdump. https://github.com/fortra/impacket/blob/master/examples/secretsdump.py We began to analyze Huntress' SIEM data for signs of compromise from affected SMA devices within these environments. We found two distinct patterns. 1.) Adversaries acting to validate exploitation against these appliances from a variety of low rep providers. 2.) Anomalous curl activity from the 'root' user of an appliance; fetching payloads from 153.75.81[.]30. Two different payloads-- ".sshd" and ".rsyncd" were noted. They were stashed in /var/tmp/ and executed through cron (rsyncd-update and sshd-update) on the SMA appliance. Analysis of the payloads confirmed these were Sliver implants, an adversary emulation framework by BishopFox. These were configured to callback to the same staging IP. https://github.com/bishopfox/sliver This would allow an adversary to linger covertly after remediation efforts. Meanwhile, @xorJosh was busy cooking away on his own analysis-- and located an open directory containing CVE validation scripts (a CN-localized Rapid7 script), "autodcsync" and "autosecretsdump" Python files, and exfiltrated credentials from numerous environments. Of note, contained next to the credentials and scripts in the open dir was 'iox' and 'frp', two direct-tunnel tools. https://github.com/eddieivan01/iox https://github.com/fatedier/frp These are noteworty chiefly because they have been favorites of numerous nation-state APT groups. The key takeaways here are clear: - SIEM saves lives; make sure logs are being forwarded and retained. - Patching might not mean you're out of the woods, adversaries are already weaponizing persistent implants to maintain access. IOCs IPv4/Port: 153.75.81[.]30:30303 - Stager Resource: 153.75.81[.30:30303/a - .rsyncd Resource: 153.75.81[.30:30303/c - .sshd IPv4/Port: 153.75.81[.30:80 - Sliver C2 Callback Cron: /etc/cron.d/rsync-update - .rsyncd Cronjob Cron: /etc/cron.d/sshd-update - .sshd Cronjob Binary: 5aa0bb8a8a298fc00935dad22e73e1effc648b1739628b782727ba7bb123cbc3 (.rsyncd) Binary: 098db74319d0798291264c643522db59fc12d65ef649d7e12c7334ea75a74a4e (.sshd) Path: /var/tmp/.rsyncd Path: /var/tmp/.sshd
Post summary
Attackers are actively exploiting CVE‑2026‑15409/10 on SonicWall SMA appliances, deploying Sliver implants via known CVE validation scripts and exfiltration tools, demonstrating real‑world usage.
012025154.1K
862 followersView on X
Rapid7@rapid791d
Patch
🚨 On 7/14/26, #SonicWall published a security advisory on 2 vulns affecting SMA1000 Series remote access appliances – CVE-2026-15409 and CVE-2026-15410. Find mitigation guidance, IoC's and more in our blog: https://r-7.co/3RfzZ3i https://t.co/otRZw3iNiW
Post summary
SonicWall disclosed two CVEs affecting SMA1000 appliances and directed readers to mitigation guidance and indicators of compromise via their blog.
0812273.6K
125.9K followersView on X
Horizon3.ai@Horizon3ai88d
PoC
🚨 Two SonicWall SMA1000 vulnerabilities. One dangerous attack chain. Rapid Response test now available for CVE-2026-15409 + CVE-2026-15410. https://t.co/URCUE1lc9D
Post summary
A Rapid Response test is now available for CVE‑2026‑15409 and CVE‑2026‑15410, indicating a PoC has been released, but no active exploitation, patch, or detailed technical vulnerability info is provided.
150141649
3.0K followersView on X
Netlas.io@Netlas_io89d
Active Exploitation
CVE-2026-15409 & CVE-2026-15410: Two exploited in the wild vulnerabilities in SonicWall SMA1000, up to 10.0 rating 🔥 Recently disclosed vulnerabilities in SonicWall SMA1000 allow an unauthenticated attacker to open a websocket-based tunnel to arbitrary localhost-only services and subsequently execute arbitrary operating system commands as root. These flaws are being actively exploited in the wild! PoC exists! 👉 https://nt.ls/I9q7F
Post summary
SonicWall SMA1000 vulnerabilities (CVE‑2026‑15409/10) are actively exploited, with PoC available, allowing attackers to create websocket tunnels and run root commands.
1401231.1K
7.7K followersView on X
Azubuike Ibe@ai_dev_official82d
Active Exploitation
SonicWall SMA 1000 zero-days are being chained. Internet-facing SSL VPN gateways. Active exploitation already underway. Two CVEs are at the centre of this. CVE-2026-15409 is an unauthenticated SSRF in the Workplace interface. CVE-2026-15410 is a code injection flaw in the Appliance Management Console. Neither is catastrophic alone. Chained together, attackers can compromise internet-facing SMA 1000 appliances without needing to start with valid credentials. That combination is what makes this move fast. SonicWall SMA appliances sit at the perimeter. They are the gateway into internal networks for remote access. Compromising one does not just give an attacker a foothold. It gives them the keys to everything that VPN is protecting. The failure mode here is familiar. VPN appliances get deployed, hardened once, and then treated as infrastructure rather than attack surface. Patches get deprioritised because downtime on a VPN gateway is disruptive. Monitoring for anomalous traffic through them is often minimal. Attackers know this. Perimeter appliances are high-value targets precisely because teams underinvest in their ongoing security posture. Patch SMA 1000 instances immediately. Segment what sits behind your VPN gateway. Monitor for unusual authentication patterns and unexpected lateral movement originating from VPN sessions. Set and forget is not a VPN security strategy. My name is Azubuike Ibe and I write about the perimeter gaps that attackers find before defenders remember to look. Patched your SonicWall SMA instances? Tell me where your team is on this. #Cybersecurity #SonicWall #VPN #ZeroDay #DevSecOps
Post summary
The narrative reports that active exploitation of SonyWall SMA 1000 zero-days is underway, highlighting chained vulnerabilities and urging urgent patching.
06066119
1.5K followersView on X
piyokango@piyokango91d
Active Exploitation
米国CISAが悪用を確認した脆弱性 #KEV をカタログに追加しました。（7/14追加） 🛡CVE-2026-15409 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability ✅概要・深刻度：緊急 10.0 (CVSS Base) / CISA-ADP ・種別：サーバサイドのリクエストフォージェリ (CWE-918) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H SonicWall SMA1000 Appliance Work Place interface に存在する SSRF の脆弱性です。未認証のリモート攻撃者が、対象アプライアンスに意図しない宛先へのリクエストを送信させる可能性があります。 ✅ChatGPTによる脆弱性評価・国内影響度：高・悪用難易度：低 ✅CISA 評価・攻撃自動化：自動化は可能・技術的影響：完全制御・BOD 26-04 対処期限（露出あり）：2026年7月17日・BOD 26-04 対処期限（露出なし）：2026年7月28日 ✅攻撃前提条件・SonicWall SMA1000 を使用している・影響を受ける 12.4.3 系または 12.5.0 系ファームウェアを使用している・攻撃者が SMA1000 Appliance Work Place interface へネットワーク経由でアクセスできる・攻撃者は認証情報を必要としない・修正済みホットフィックスバージョンへ更新されていない ✅悪用時影響・対象アプライアンスから意図しない宛先へリクエストを送信させられる可能性がある・内部ネットワークや内部サービスへの到達確認に悪用される可能性がある・SMA1000 アプライアンスを経由した追加侵害の足掛かりにされる可能性がある・機密性、完全性、可用性に高い影響が生じる可能性がある ✅悪用事例等に関する公開情報・PoC/Exploit：公開情報確認できず・ITW：確認済み（SonicWall）・概要：SonicWall は、CVE-2026-15409 および CVE-2026-15410 が実際に悪用されていることを確認したと公表 ✅関連情報・https://nvd.nist.gov/vuln/detail/CVE-2026-15409 ・https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008 ・https://www.sonicwall.com/support/notices/product-notice-sma-1000-series-affected-by-multiple-vulnerabilities/kA1VN000001nv6D0AQ ・https://github.com/cisagov/vulnrichment/blob/develop/2026/15xxx/CVE-2026-15409.json ・https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409 🛡CVE-2026-15410 SonicWall SMA1000 Appliances Code Injection Vulnerability ✅概要・深刻度：重要 7.2 (CVSS Base) / CISA-ADP ・種別：コード・インジェクション (CWE-94) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H SonicWall SMA1000 Appliance Management Console に存在するコードインジェクションの脆弱性です。特定条件下で、管理者として認証済みのリモート攻撃者が任意の OS コマンドを実行できる可能性があります。 ✅ChatGPTによる脆弱性評価・国内影響度：高・悪用難易度：中 ✅CISA 評価・攻撃自動化：自動化は困難・技術的影響：完全制御・BOD 26-04 対処期限（露出あり）：2026年7月17日・BOD 26-04 対処期限（露出なし）：2026年7月28日 ✅攻撃前提条件・SonicWall SMA1000 を使用している・影響を受ける 12.4.3 系または 12.5.0 系ファームウェアを使用している・攻撃者が SMA1000 Appliance Management Console へネットワーク経由でアクセスできる・攻撃者が管理者権限の認証情報または管理者セッションを持っている・修正済みホットフィックスバージョンへ更新されていない ✅悪用時影響・SMA1000 アプライアンス上で任意の OS コマンドを実行される可能性がある・アプライアンスの設定を改ざんされる可能性がある・認証情報や構成情報を窃取される可能性がある・VPN ゲートウェイを起点に内部ネットワークへ追加侵害される可能性がある・機密性、完全性、可用性に高い影響が生じる可能性がある ✅悪用事例等に関する公開情報・PoC/Exploit：公開情報確認できず・ITW：確認済み（SonicWall）・概要：SonicWall は、CVE-2026-15409 および CVE-2026-15410 が実際に悪用されていることを確認したと公表 ✅関連情報・https://nvd.nist.gov/vuln/detail/CVE-2026-15410 ・https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008 ・https://www.sonicwall.com/support/notices/product-notice-sma-1000-series-affected-by-multiple-vulnerabilities/kA1VN000001nv6D0AQ ・https://github.com/cisagov/vulnrichment/blob/develop/2026/15xxx/CVE-2026-15410.json ・https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15410 🛡CVE-2026-56155 Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability ✅概要・深刻度：重要 7.8 (CVSS Base) / Microsoft Corporation (CNA) ・種別：アクセス制御の不十分な粒度 (CWE-1220) ・CVSS:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Active Directory Federation Services に存在する、アクセス制御の粒度不足に起因する権限昇格の脆弱性です。 AD FS がトークン署名証明書およびトークン暗号化証明書の秘密鍵を保護するために使用する DKM コンテナの ACL が過度に許可されている場合、DKM キー素材へアクセス可能な攻撃者がトークン署名秘密鍵を復号できる可能性があります。 Microsoft は 2026年7月14日の Windows セキュリティ更新で、DKM コンテナ ACL の監査および段階的なハードニングを開始しています。 ✅ChatGPTによる脆弱性評価・国内影響度：高・悪用難易度：高 ✅CISA 評価・攻撃自動化：自動化は困難・技術的影響：完全制御・BOD 26-04 対処期限（露出あり）：2026年7月17日・BOD 26-04 対処期限（露出なし）：2026年7月28日 ✅攻撃前提条件・Active Directory Federation Services を使用している・影響を受ける Windows Server または Windows Server Core 環境を使用している・DKM コンテナの ACL が過度に許可された状態である・攻撃者がローカルで低権限の権限を持っている・攻撃者が DKM キー素材へ読み取りアクセスできる状態である・2026年7月14日以降の Windows セキュリティ更新、または Microsoft の DKM ACL ハードニング手順が適用されていない ✅悪用時影響・DKM キー素材を読み取られる可能性がある・トークン署名証明書の秘密鍵を復号される可能性がある・AD FS のトークン署名機能を悪用される可能性がある・認証基盤上で権限昇格につながる可能性がある・フェデレーション認証環境におけるなりすましや不正アクセスにつながる可能性がある ✅悪用事例等に関する公開情報・PoC/Exploit：公開情報確認できず・ITW：未確認 ✅関連情報・https://nvd.nist.gov/vuln/detail/CVE-2026-56155 ・https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155 ・https://support.microsoft.com/en-us/servicing/os/windows/docs/2026/07/kb5121391-cve-2026-56155-ad-fs-dkm-container-acl-hardening ・https://github.com/cisagov/vulnrichment/blob/develop/2026/56xxx/CVE-2026-56155.json ・https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56155 🛡CVE-2026-56164 Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability ✅概要・深刻度：緊急 9.8 (CVSS Base) / NVD、注意 5.3 (CVSS Base) / Microsoft Corporation (CNA) ・種別：重要な機能に対する認証の欠如 (CWE-306) ・CVSS:NVD=CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H / Microsoft Corporation (CNA)=CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Microsoft SharePoint Server に存在する、重要な機能に対する認証欠如の脆弱性です。未認証の攻撃者がネットワーク経由で悪用することで、SharePoint Server 上で権限昇格できる可能性があります。 ✅ChatGPTによる脆弱性評価・国内影響度：高・悪用難易度：低 ✅CISA 評価・攻撃自動化：自動化は可能・技術的影響：部分的・BOD 26-04 対処期限（露出あり）：2026年7月17日・BOD 26-04 対処期限（露出なし）：2026年7月28日 ✅攻撃前提条件・Microsoft SharePoint Server を使用している・Microsoft SharePoint Enterprise Server 2016 で 16.0.5561.1001 未満を使用している・Microsoft SharePoint Server 2019 で 16.0.10417.20175 未満を使用している・Microsoft SharePoint Server Subscription Edition で 16.0.19725.20434 未満を使用している・攻撃者が対象 SharePoint Server へネットワーク経由でアクセスできる・攻撃者は認証情報を必要としない・修正済み更新プログラムが適用されていない ✅悪用時影響・未認証の攻撃者に権限昇格される可能性がある・SharePoint Server 上の重要機能を不正に利用される可能性がある・SharePoint 環境上の情報へ不正アクセスされる可能性がある・他の SharePoint 脆弱性や侵害後活動と組み合わせて悪用される可能性がある・オンプレミス SharePoint 環境を起点に追加侵害へつなげられる可能性がある ✅悪用事例等に関する公開情報・PoC/Exploit：一部公開（技術情報のみ）・ITW：確認済み（CISA） ✅関連情報・https://nvd.nist.gov/vuln/detail/CVE-2026-56164 ・https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164 ・https://github.com/cisagov/vulnrichment/blob/develop/2026/56xxx/CVE-2026-56164.json ・https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56164 ・https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-adds-four-known-exploited-vulnerabilities-catalog #vulnerability
Post summary
The text reports that four CVEs, including two SonicWall SSRF and code injection flaws, have been actively exploited in the wild as confirmed by CISA and vendors, provides detailed technical and patch information, but does not supply PoC or exploit code.
0201415.8K
44.2K followersView on X
CERT-FR@CERT_FR91d
Active Exploitation
⚠️Alerte CERT-FR⚠️ Les vulnérabilités CVE-2026-15409 et CVE-2026-15410 affectent les SMA 1000 et permettent une SSRF ainsi que d'exécuter du code arbitraire à distance. Elles sont activement exploitées.
Post summary
CERT‑FR reports that CVE-2026-15409 and CVE-2026-15410 in SMA 1000 devices allow SSRF and remote code execution, and that these vulnerabilities are currently being exploited in the wild.
031735.5K
58.2K followersView on X
!Manan@0xManan19d
Active Exploitation
Your Sonicwall SMA1000 “WorkPlace” portal might be a free websocket tunnel into localhost. CVE-2026-15409 (CVSS 10.0) + CVE-2026-15410. Both on CISA KEV. Actively exploited before the advisory even dropped. Chain: `/wsproxy?host=…&port=1050` (unauth SSRF) → Erlang dist on localhost → hardcoded cookie → `os:cmd/1` as couchdb → path-traversal `remove_hotfix` on :8188 → root script + reboot Not SSL VPN on the firewall. SMA1000 Series 6210/7210/8200v. Patch to 12.4.3-03453+ or 12.5.0-02835+. PoC (Python, Rapid7): https://github.com/remmons-r7/rapid7-CVE-2026-15409 Nuclei detect: projectdiscovery nuclei-templates `CVE-2026-15409` Metasploit: `exploit/linux/http/sonicwall_sma1000_wsproxy_rce` If you still have an SMA1000 on the internet, assume it was probed. Forensic the `wsproxy` 101s and re-image if weird. Bookmark if you run remote-access appliances. Repost if your SOC still thinks “VPN box = boring.”
Post summary
CVE-2026-15409/15410 are confirmed actively exploited in the wild via CISA KEV, with PoC code, Metasploit module, and detailed attack chain disclosed, and specific patched versions recommended.
01061430
2.3K followersView on X
ransomNews@ransomnews69d
Active Exploitation
🚨 INC Ransomware chains SonicWall zero-days for ransomware The group exploited CVE-2026-15409 and CVE-2026-15410 to steal data and deploy ransomware. 🔗 read more: https://cyberscoop.com/inc-ransomware-sonicwall-zero-day-attacks/ #ransomNews #cybersecurity
Post summary
INC ransomware exploited two SonicWall zero‑day CVEs in the wild, using them to steal data and deploy ransomware, confirming active exploitation.
04031606
3.6K followersView on X
GovCERT.CZ@GOVCERT_CZ91d
Active Exploitation
🚨 Upozorňujeme na kritické, aktivně zneužívané zranitelnosti v SonicWall SMA1000 Series Secure Mobile Access appliances, CVE-2026-15409 a CVE-2026-15410. Zranitelnost CVE-2026-15409 je kritická chyba typu Server-Side Request Forgery (SSRF) v rozhraní SMA1000 Appliance Work Place s CVSS 10.0. Vzdálený neautentizovaný útočník může tuto chybu zneužít tak, že zařízení donutí zaslat požadavky na nechtěné interní nebo externí cíle, což může vést k přístupu k interním službám, obcházení síťových omezení a dalšímu kompromitování. Zranitelnost CVE-2026-15410 je post-authentication Code Injection chyba v SMA1000 Appliance Management Console s CVSS 7.2, kterou může za specifických podmínek zneužít autentizovaný administrátor ke spuštění libovolných příkazů operačního systému, což může vést ke kompletnímu kompromitování systému. Obě zranitelnosti jsou podle SonicWall PSIRT aktivně zneužívány. Postiženy jsou appliance SonicWall SMA1000 Series včetně SMA 6210, SMA 7210 a SMA 8200v ve verzích 12.4.3-03245, 12.4.3-03387, 12.4.3-03434, 12.5.0-02283, 12.5.0-02624 a 12.5.0-02800. V komentáři přikládáme odkaz na stránky výrobce, kde jsou dostupné indikátory kompromitace (IoC). 📌Doporučujeme aktualizovat na verzi 12.4.3-03453 (platform-hotfix) nebo novější, případně 12.5.0-02835 (platform-hotfix) nebo novější.
Post summary
The text reports that CVE-2026-15409 and CVE-2026-15410 are actively exploited against SonicWall SMA1000 appliances, provides technical details and affected versions, and recommends specific hotfix updates.
13040994
4.3K followersView on X
مالك الدوسري/Malek Aldossary@MAlajab64d
Patch
إذا كان لديك SonicWall موديل SMA1000، قم بالتحديث على الفور وذلك بعد اكتشاف ثغرتين عالية الخطورة،والتي أكدت الشركة استغلالهما، الثغرتين تحمل رقم (CVE-2026-15409 و CVE-2026-15410)،الاولى عباره عن SSRF والأخرى عباره عن حق أوامر ضارة. #الامن_السيبراني https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008
Post summary
SonicWall SMA1000 users are urged to update immediately because two high‑severity CVEs (CVE‑2026‑15409 SSRF and CVE‑2026‑15410 remote command execution) have been confirmed as exploited, with a vendor advisory available.
000334.1K
113.9K followersView on X
ET Labs@ET_Labs88d
General
14 new OPEN, 16 new PRO (14 + 2) CVE-2026-15410 (Sonicwall SMA1000 Path Traversal), CVE-2023-32707 (Splunk edit_users privesc), Landupdate808, TA569, ZPHP, Atera/AlphaControl RMM, and more. https://community.emergingthreats.net/t/ruleset-update-summary-2026-07-17-v11236/3389
Post summary
The update lists new rules covering CVE‑2026‑15410 (Sonicwall Path Traversal) and CVE‑2023‑32707 (Splunk privilege escalation) among other threats, but gives no PoC, exploit code, patch details, or evidence of active exploitation.
02040357
5.7K followersView on X
Help Net Security@helpnetsecurity92d
Active Exploitation
SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410) - https://www.helpnetsecurity.com/2026/07/14/sonicwall-sma-attacks-via-cve-2026-15409-cve-2026-15410/ - @SonicWall #CVE #CyberSecurity #CyberSecurityNews
Post summary
Zero‑day attacks are reported against SonicWall SMA appliances utilizing CVE‑2026‑15409 and CVE‑2026‑15410, indicating the vulnerabilities are being actively exploited.
01041656
60.2K followersView on X
Eric Taylor@bcs_erictaylor82d
Patch
I mentioned two days ago that we are tracking INC Ransomware group are targeting Sonicwall CVE's (CVE-2026-15409 and CVE-2026-15410). We now see Scattered Spider (known RaaS "sub-contractor") pushing out how to find devices on the internet showcasing vulnerable devices. If you have a SonicWall SMA1000, please stop reading and patch now. #CTI #threatintel #Sonicwall #ScatteredSpider
Post summary
The post alerts that SonicWall devices may be targeted by ransomware groups exploiting CVE-2026-15409/15410 and urges users to patch their SMA1000 units.
00032269
689 followersView on X
AlexAImaginator@TraffAlex85d
Disclosure
🔒 CYBERSECURITY, PRIVACY & OPEN SOURCE ROUNDUP — July 21, 2026 1️⃣ CHROME ZERO-DAY: CVE-2026-9883 ENABLES REMOTE CODE EXECUTION A critical use-after-free vulnerability in Google Chrome versions below 148.0.7778.216 has been assigned CVE-2026-9883 with a CVSS score of 8.8. Attackers can execute arbitrary remote code through specially crafted HTML pages. The DFIR Lab flagged this as a high-priority patch — any unpatched browser instance is exploitable via a simple browsing action. Chrome users are advised to update immediately, as drive-by attacks leveraging this flaw are likely already in the wild. 🔹 @DFIR_Lab 2️⃣ STOLEN CREDENTIALS NOW DRIVE 79% OF RANSOMWARE ATTACKS According to a new Sophos report highlighted by SC Media, stolen credentials have overtaken traditional exploit-based attacks as the primary entry point for ransomware operations. Attackers are increasingly shifting their focus from technical exploits to identity compromise, making strong multi-factor authentication and identity governance more critical than ever. This trend underscores why zero-trust frameworks and least-privilege access policies are no longer optional — they are essential defenses against the modern ransomware threat landscape. 🔹 @SCMagazine 3️⃣ QILIN RANSOMWARE EXPLOITS PAN-OS GLOBALPROTECT AUTH BYPASS The Qilin ransomware group is actively exploiting CVE-2026-0257 in Palo Alto Networks PAN-OS software, which allows authentication bypass in the GlobalProtect portal and gateway. Arctic Wolf reported multiple cases in June where attackers used this vulnerability to gain unauthorized VPN access and encrypt domain controllers through auth-override cookies. Organizations running PAN-OS should patch immediately, terminate active GlobalProtect sessions after patching, and hunt for anomalous VPN login patterns across their environments. 🔹 @snypet86 4️⃣ SONICWALL SMA ZERO-DAYS EXPLOITED BEFORE PUBLIC DISCLOSURE Two critical zero-day vulnerabilities in SonicWall Secure Mobile Access (SMA) appliances — CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410 (CVSS 7.2) — were actively exploited in the wild before they were publicly disclosed. When chained together, these flaws allow arbitrary command execution and full root access to affected appliances. The CVSS 10.0 score on the primary vulnerability indicates the severity is at the highest possible level. Any organization relying on SonicWall SMA for remote access should verify patching status without delay. 🔹 @riskigy 5️⃣ ZIMBRA PATCHES CRITICAL SNMP COMMAND INJECTION AND FOUR XSS FLAWS Zimbra has released security fixes addressing multiple critical vulnerabilities, most notably a command injection flaw in the Simple Network Management Protocol (SNMP) monitoring component. Alongside this, four cross-site scripting vulnerabilities were patched. The SNMP command injection could allow remote attackers to execute arbitrary system commands on affected Zimbra servers. Organizations running Zimbra collaboration suites should apply the vendor patches immediately and review SNMP monitoring configurations for exposure. 🔹 @cybertzar 6️⃣ BTMOB RAT V4.6 SOURCE CODE FOR SALE ON CYBERCRIME FORUMS CyberWatch reported that a threat actor is advertising the sale of the alleged BTMOB Remote Access Trojan version 4.6 source code on a cybercrime forum. This Android malware framework supports remote device administration and control, live camera and microphone access, SMS interception, contact and call log harvesting, and GPS tracking. The availability of its source code means copycat malware variants can emerge rapidly, making this a significant threat to Android device security across the board. 🔹 @CyberWatch05 7️⃣ BELLSoft LAUNCHES HARDENED BUILDER FOR PAKETO BUILDPACKS WITH ZERO-CVE IMAGES BellSoft announced a hardened builder for Paketo Buildpacks, built on BellSoft Hardened Images. The solution provides teams with a secure-by-design baseline featuring low-to-zero-CVE base images at the time of release, backed by continuous patching under a service-level agreement. No application code changes are required to adopt the hardened images, making it an accessible upgrade for teams looking to improve container security posture without refactoring their CI/CD pipelines. 🔹 @bellsoftware 💭 The threat landscape this week is dominated by supply chain and identity attacks — from stolen credentials fueling ransomware to zero-days in critical networking and browser infrastructure. The common thread? Attackers are exploiting the path of least resistance: unpatched systems, weak authentication, and exposed management interfaces. Hardening your base images, enforcing MFA everywhere, and maintaining rigorous patching schedules are the three most impactful actions any security team can take right now. Which of these vulnerabilities should your team prioritize patching first — the Chrome zero-day or the SonicWall SMA flaws? Share your take below 👇 #Cybersecurity #ZeroDay #CVE #Ransomware #OpenSource #InfoSec #Privacy
Post summary
The roundup announces multiple critical CVEs, confirms their active exploitation, and emphasizes immediate patching for vulnerable systems.
10022662
2.7K followersView on X

CPE platform detail21 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

21 of 21 entries

Part	Vendor	Product	Version	Target SW	Target HW
HW	sonicwall	sma6210	-	-	-
OS	sonicwall	sma6210_firmware	12.4.3-03245	-	-
OS	sonicwall	sma6210_firmware	12.4.3-03387	-	-
OS	sonicwall	sma6210_firmware	12.4.3-03434	-	-
OS	sonicwall	sma6210_firmware	12.5.0-02283	-	-
OS	sonicwall	sma6210_firmware	12.5.0-02624	-	-
OS	sonicwall	sma6210_firmware	12.5.0-02800	-	-
HW	sonicwall	sma7210	-	-	-
OS	sonicwall	sma7210_firmware	12.4.3-03245	-	-
OS	sonicwall	sma7210_firmware	12.4.3-03387	-	-
OS	sonicwall	sma7210_firmware	12.4.3-03434	-	-
OS	sonicwall	sma7210_firmware	12.5.0-02283	-	-
OS	sonicwall	sma7210_firmware	12.5.0-02624	-	-
OS	sonicwall	sma7210_firmware	12.5.0-02800	-	-
App	sonicwall	sma8200v	-	-	-
App	sonicwall	sma8200v	12.4.3-03245	-	-
App	sonicwall	sma8200v	12.4.3-03387	-	-
App	sonicwall	sma8200v	12.4.3-03434	-	-
App	sonicwall	sma8200v	12.5.0-02283	-	-
App	sonicwall	sma8200v	12.5.0-02624	-	-
App	sonicwall	sma8200v	12.5.0-02800	-	-

Explore more

Back to dashboard sonicwall CVEs sma6210 vulnerabilities

What researchers are saying

CVE-2026-15410

Rishi[verified]@rxeriumActive Exploitation

This post announces that two zero‑day CVEs (CVE‑2026‑15409 and CVE‑2026‑15410) are actively exploited against SonicWall SMA1000 appliances, provides detection templates and notes that hotfixes are available.

Stephen Fewer[verified]@stephenfewerExploit

The post announces a proof‑of‑concept and functional exploit code for CVE‑2026‑15409, highlights that the vulnerability is currently being exploited in the wild, and shares IOCs via a Rapid7 blog.

Rem[verified]@sudo_RemExploit

Attackers are actively exploiting CVE‑2026‑15409/10 on SonicWall SMA appliances, deploying Sliver implants via known CVE validation scripts and exfiltration tools, demonstrating real‑world usage.

Horizon3.ai[verified]@Horizon3aiPoC

A Rapid Response test is now available for CVE‑2026‑15409 and CVE‑2026‑15410, indicating a PoC has been released, but no active exploitation, patch, or detailed technical vulnerability info is provided.

Netlas.io[verified]@Netlas_ioActive Exploitation

SonicWall SMA1000 vulnerabilities (CVE‑2026‑15409/10) are actively exploited, with PoC available, allowing attackers to create websocket tunnels and run root commands.

Azubuike Ibe[verified]@ai_dev_officialActive Exploitation

The narrative reports that active exploitation of SonyWall SMA 1000 zero-days is underway, highlighting chained vulnerabilities and urging urgent patching.

piyokango[verified]@piyokangoActive Exploitation

The text reports that four CVEs, including two SonicWall SSRF and code injection flaws, have been actively exploited in the wild as confirmed by CISA and vendors, provides detailed technical and patch information, but does not supply PoC or exploit code.

!Manan[verified]@0xMananActive Exploitation

CVE-2026-15409/15410 are confirmed actively exploited in the wild via CISA KEV, with PoC code, Metasploit module, and detailed attack chain disclosed, and specific patched versions recommended.