SonicWall SMA1000 Vulnerabilities Now Weaponized by Ransomware Operators

The U.S. cybersecurity agency CISA has reported that two vulnerabilities in SonicWall SMA1000 devices are now being leveraged in ransomware attacks. The flaws, tracked as CVE-2026-15409 and CVE-2026-15410, include a server-side request forgery (SSRF) bug rated at the maximum severity level.

The SMA1000 is an enterprise secure remote access gateway. It is used by large companies, government agencies and managed security service providers (MSSPs) to grant VPN access to internal applications and corporate networks. Compromising such a device opens a path into the internal infrastructure, which is exactly what makes it such a tempting target.

Timeline

SonicWall released the patches in mid-July, warning at the same time that the vulnerabilities were already being exploited in zero-day attacks. According to the company's PSIRT, several cases of active exploitation had been investigated, and customers were strongly urged to apply the fixes as soon as possible.

Incident response firm Volexity later determined that a group tracked as UTA0533 had begun exploiting the flaws as early as June 22 — several weeks before their public disclosure. On the vulnerable VPN devices, the attackers deployed their own malware known under the names KNUCKLEBALL, Sou5, ROOTRUN and ORANGETAIL.

The Shadowserver monitoring service currently counts more than 380 SMA1000 devices exposed to the internet, though some of them may already be protected.

Regulator's Response

CISA added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog back on July 14, requiring federal civilian agencies to apply the patches within three days — an unusually tight deadline that underscores the severity of the threat. The agency has now additionally flagged the flaws as being used in ransomware attacks. SonicWall itself, however, has not yet updated its original advisory to confirm the link to the ransomware campaigns.

This is not the first alarming episode for SonicWall in recent times. In December, the company urged customers to close another vulnerability (CVE-2025-40602) in the SMA1000 management console, which attackers had been chaining together to gain root privileges. Earlier, the vendor had linked a September leak of firewall configuration backups to the activities of state-sponsored hackers, and had also released a firmware update to remove the OVERSTEP rootkit from SMA 100 series devices.

Organizations using the SMA1000 should immediately apply the released fixes and check their devices for signs of compromise.

Source: Bleeping Computer