Updated

Updated · hkcert.org · Jul 15

SonicWall SMA1000 Flaws CVE-2026-15409 and CVE-2026-15410 Face Active Exploitation

Updated

Updated · hkcert.org · Jul 15

SonicWall SMA1000 Flaws CVE-2026-15409 and CVE-2026-15410 Face Active Exploitation

Q: Which state-sponsored hackers are using this SonicWall flaw to breach government and corporate networks?

No state-sponsored hacking group has been publicly identified so far as the actor exploiting the SonicWall SMA1000 zero-days CVE-2026-15409 and CVE-2026-15410. What is confirmed is that SonicWall, CISA and outside incident responders have said the flaws are being actively exploited in the wild, including in zero-day attacks against government and corporate targets. CISA added both bugs to its Known Exploited Vulnerabilities catalog on July 14, 2026, which is a strong signal of real-world abuse, but neither CISA nor SonicWall has attributed the campaign to a named nation-state group. The available reporting also says attribution remains unclear. Volexity assisted the investigation and helped expand indicators of compromise, but the public advisories focus on exploitation activity, affected firmware, and remediation steps rather than naming an operator. There is broader evidence that state-backed actors, including China-linked groups, have targeted edge devices and SonicWall products in past campaigns. But that is context, not proof tied to these two newly disclosed SMA1000 flaws. For now, the most accurate answer is that the attackers have not been publicly named. Organizations should treat this as an urgent active-compromise risk, apply SonicWall’s hotfixes immediately, and check for signs of intrusion before assuming patching alone is sufficient.

3 articles · Updated · hkcert.org · Jul 15

Two SonicWall SMA1000 vulnerabilities — CVE-2026-15409 and CVE-2026-15410 — are being exploited in the wild, with authorities rating the threat to the appliances as high risk.
CVE-2026-15409 is an unauthenticated server-side request forgery flaw that can force an appliance to send requests to unintended locations, while CVE-2026-15410 is a post-authentication code-injection bug in the AMC console.
That second flaw can let a remote authenticated administrator execute arbitrary OS commands, and the combined impact listed for the vulnerabilities includes remote code execution and security restriction bypass.
Affected products include SMA1000 models 6210, 7210 and 8200v on specified 12.4.3 and 12.5.0 releases, with users urged to apply vendor-issued fixes.