SonicWall SMA1000 Zero-Days Exploited To Breach Enterprise Networks

Ransomware operators are actively exploiting two recently patched SonicWall Secure Mobile Access 1000 vulnerabilities to obtain root-level control of internet-facing remote-access appliances, steal credentials and move deeper into corporate networks.

The US Cybersecurity and Infrastructure Security Agency has updated its Known Exploited Vulnerabilities catalogue to identify CVE-2026-15409 and CVE-2026-15410 as vulnerabilities known to have been used in ransomware campaigns. Both flaws were already added to the catalogue on July 14 following confirmation that attackers had exploited them as zero-days.