Resecurity reports that the INC ransomware operation has become the dominant group exploiting two SonicWall SMA1000 VPN appliance flaws, accelerating its attacks since early August. The pair, CVE-2026-15409 and CVE-2026-15410, were exploited as zero-days before SonicWall patched them in mid-July, and can be chained to gain root on the appliance and extract credentials, session databases, and one-time-password data. Many appliances remain unpatched or already compromised, leaving footholds attackers can reuse. Victims listed recently span private and government organizations across several countries, and some reported follow-up emails and phone calls from people claiming to help with the ransomware.
Incident response firm Volexity detailed how attackers chained two SonicWall SMA1000 flaws as zero-days weeks before the vendor disclosed them, reaching root and installing malware built specifically for the appliances. A previously unknown actor it tracks as UTA0533 began exploiting on June 22, nearly three weeks before the July 14 advisory. The chain starts with CVE-2026-15409 against the /wsproxy endpoint, letting an unauthenticated attacker open WebSocket tunnels to services meant to be reachable only from the appliance itself, then uses CVE-2026-15410 for command execution. With root, the actor could read stored credentials, capture traffic, and intercept credentials the appliance processes.
SonicWall is warning that two flaws in its SMA1000 remote-access appliances are being actively exploited as zero-days, and has released hotfixes. CVE-2026-15409 is an unauthenticated server-side request forgery bug in the appliance's WorkPlace interface that lets an attacker make the device send requests to internal systems, turning an edge gateway into a pivot point. CVE-2026-15410 is a code-injection flaw in the management console that lets an administrator run operating-system commands, and SonicWall rates the overall advisory a top CVSS score of 10.0. Both were added to CISA's exploited-vulnerabilities catalog, with a federal deadline of July 17. Because exploitation is confirmed, any unpatched appliance should be treated as potentially compromised.
TrustStrike Labs