SonicWall customers under threat as attackers exploit 2 zero-days

SonicWall publicly disclosed two zero-day vulnerabilities Tuesday in a security advisory, confirming that attackers are actively exploiting the defects in SMA1000 appliances. The company credited an employee with discovering the vulnerabilities, identified as CVE-2026-15409 and CVE-2026-15410, but did not say when the discovery occurred or the earliest known instance of exploitation. Rapid7 researchers told CyberScoop both vulnerabilities were first exploited June 22. Seth Lazarus, senior manager of detection and response services at Rapid7, said the goal is likely ransomware, though Rapid7 prevented actors from achieving exfiltration and encryption. Overlapping tactics indicate the same threat group discovered and exploited the zero-days, Lazarus added. SonicWall did not answer questions about the impacts of the attacks and has not attributed them to a known group. The vendor confirmed to CyberScoop that both vulnerabilities have been chained together for exploitation. The Cybersecurity and Infrastructure Security Agency added both zero-days to its known exploited vulnerabilities catalog Tuesday. SonicWall encouraged customers to patch by upgrading to the latest software version released upon disclosure and shared indicators of compromise. Bret Fitzgerald, senior director of global communications at SonicWall, said speed of response was a priority and mitigation efforts are underway. Fitzgerald said the company monitors about one million sensors globally and SMA1000 appliances represent a very small subset of that footprint, less than 5,000 units. SonicWall said support staff are helping customers work through instances of suspicious activity, warning that patching alone is not sufficient.