Critical

SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410)

Help Net Security

July 14, 2026 at 5:40 PM

Actively Exploited

Overview

SonicWall has identified two vulnerabilities in its Secure Mobile Access (SMA) 1000 Series appliances, known as CVE-2026-15409 and CVE-2026-15410, which are currently being exploited by attackers. The company is urging its customers to upgrade to a fixed firmware version immediately and to check for signs of compromise on their systems. If any indicators of compromise are found, SonicWall recommends that organizations re-image their hardware or redeploy their virtual appliances, change all user and administrator passwords, and reset any Time-based One-Time Password (TOTP) tokens. This situation raises concerns for organizations relying on these appliances for secure remote access, as attackers could exploit these vulnerabilities to gain unauthorized access to sensitive information. Swift action is essential to mitigate potential risks.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: SonicWall Secure Mobile Access (SMA) 1000 Series appliances
Action Required: Upgrade to the fixed firmware version provided by SonicWall.
Timeline: Newly disclosed

Original Article Summary

SonicWall has fixed two actively exploited vulnerabilities (CVE-2026-15409, CVE-2026-15410) affecting its Secure Mobile Access (SMA) 1000 Series appliances, and is urging customer organizations to upgrade to a fixed firmare version and search for evidence of potential compromise. If the outlined indicators of compromise are present on the system, the company advises re-imaging (hardware) or re-deploying (virtual) appliances, changing user and administrator passwords, and resetting TOTP tokens. The vulnerabilities SonicWall SMA 1000 series appliances are secure … More → The post SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410) appeared first on Help Net Security.

Impact

SonicWall Secure Mobile Access (SMA) 1000 Series appliances

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Upgrade to the fixed firmware version provided by SonicWall. If indicators of compromise are detected, re-image hardware or redeploy virtual appliances, change user and administrator passwords, and reset TOTP tokens.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to CVE, Zero-day, Exploit, and 1 more.

Read Original Article

Related Coverage

Nearly 300 GitHub repos pose as legit software to push malware

BleepingComputer

A threat actor has created nearly 300 fake GitHub repositories that mimic legitimate software and security projects to spread infostealer malware. This malware is designed to steal sensitive information from users who mistakenly download these malicious programs, thinking they are legitimate. Researchers discovered that these counterfeit repositories could easily deceive unsuspecting developers and users, leading to potential data breaches. The incident raises concerns about the security of open-source platforms like GitHub, where users often rely on repository authenticity to download software safely. Users and organizations need to be vigilant and verify the legitimacy of software before downloading to avoid falling victim to these types of attacks.

Jul 14, 2026

Synopsys Finds No Evidence of Data Breach Amid Bosch Hack Claims

SecurityWeek

The D1R cybercrime group has claimed responsibility for stealing sensitive data from both Synopsys and Bosch, threatening to release the information unless a ransom is paid. However, Synopsys has conducted an investigation and found no evidence that any data breach occurred on their end. This situation raises concerns about the potential for misinformation and the tactics used by cybercriminals to instill fear and pressure companies into paying ransoms. It also highlights the need for organizations to remain vigilant and prepared for such threats, even when claims do not hold up under scrutiny. The implications of these threats can be significant, particularly for companies that handle sensitive data, as they can affect reputation and trust among customers.

Jul 14, 2026

SAP Patches CVSS 9.9 NetWeaver ABAP Flaw That Could Expose or Modify Data

The Hacker News

SAP has issued critical updates in July 2026 to fix several vulnerabilities, including a serious flaw in the SAP NetWeaver Application Server ABAP, identified as CVE-2026-44747. This vulnerability has a CVSS score of 9.9 and involves an out-of-bounds write issue that could allow an authenticated attacker to exploit memory management errors. If successfully executed, this could lead to memory corruption, potentially enabling attackers to expose or modify sensitive data. Organizations using the affected SAP NetWeaver Application Server should prioritize these updates to protect their systems from possible exploitation. Timely patching is crucial to maintaining the integrity and confidentiality of their data.

Jul 14, 2026

Upwind Finds Coordinated Supply Chain Campaign Compromising Multiple AsyncAPI npm Packages

Hackread – Cybersecurity News, Data Breaches, AI and More

Researchers at Upwind have identified a coordinated supply chain attack that has compromised multiple AsyncAPI npm packages. This attack affects various repositories, publishing pipelines, and developer systems, putting many developers at risk. The compromised packages could potentially allow attackers to inject malicious code into applications that rely on these libraries, posing a significant threat to the integrity of software projects. Developers using these AsyncAPI packages should be vigilant and assess their systems for any signs of compromise. This incident serves as a reminder of the vulnerabilities within software supply chains and the need for enhanced security measures.

Jul 14, 2026

Adobe Patches Critical ColdFusion Vulnerabilities

SecurityWeek

Adobe has released patches to address serious vulnerabilities in ColdFusion that could allow attackers to run arbitrary code or gain elevated privileges. These flaws pose a significant risk to users and organizations that rely on ColdFusion for web applications. If exploited, they could lead to unauthorized access and potential data breaches. It’s crucial for affected users to apply these updates as soon as possible to protect their systems from potential attacks. Adobe's quick response highlights the ongoing need for vigilance in maintaining software security.

Jul 14, 2026

Progress confirms ShareFile zero-day flaw behind Storage Zone shutdown

BleepingComputer

Progress Software has confirmed that a serious zero-day vulnerability led to the emergency shutdown of ShareFile Storage Zone Controllers last week. Users of ShareFile, a cloud-based file sharing and storage service, were affected as the company worked to address the flaw. Progress has since released security updates to patch this vulnerability, which could have potentially allowed unauthorized access or data breaches. This incident is significant because it underscores the risks associated with cloud storage services, highlighting the need for users to ensure their systems are updated promptly to protect sensitive data.

Jul 14, 2026