SonicWall SMA1000, an enterprise-grade secure remote access gateway, was found vulnerable to two critical security flaws (CVE-2026-15409 and CVE-2026-15410), including a maximum-severity SSRF vulnerability. These flaws were exploited in zero-day attacks by threat actors, including ransomware gangs, to deploy custom malware such as KNUCKLEBALL, Sou5, ROOTRUN, and ORANGETAIL. SonicWall released patches in mid-July 2026 and urged immediate upgrades. CISA added these vulnerabilities to its Known Exploited Vulnerabilities Catalog and required federal agencies to patch within three days. The vulnerabilities pose significant risks by enabling unauthorized access and malware deployment on exposed SMA1000 VPN appliances.

Exploitation of these vulnerabilities allows attackers to perform server-side request forgery attacks and potentially execute arbitrary code or deploy malware on SonicWall SMA1000 devices. This can lead to unauthorized access to internal networks, deployment of ransomware, and compromise of sensitive enterprise resources. The active exploitation by ransomware gangs increases the risk of operational disruption and data loss for affected organizations.

SonicWall has released official patches for CVE-2026-15409 and CVE-2026-15410. Customers are strongly urged to apply the hotfix releases immediately to remediate these vulnerabilities. CISA mandates patching within three days for federal agencies. No additional mitigation steps are indicated beyond applying the official patches. Organizations should verify that their SMA1000 appliances are updated to the patched versions to prevent exploitation.