SonicWall SMA1000 vulnerabilities exploited by ransomware gangs

SonicWall SMA1000 ransomware CISA Known Exploited Vulnerabilities cybersecurity zero-day exploitation

Ransomware gangs are actively exploiting vulnerabilities in SonicWall SMA1000 enterprise-grade secure remote access gateways. The flaws, tracked as CVE-2026-15409 and CVE-2026-15410, include a maximum-severity server-side request forgery (SSRF) vulnerability. CISA has added these to its Known Exploited Vulnerabilities (KEV) catalog, ordering federal agencies to patch their systems.

Security researchers, including Volexity, identified that threat actors began exploiting these vulnerabilities as early as June 22, prior to public disclosure, to deploy custom malware such as KNUCKLEBALL, Sou5, ROOTRUN, and ORANGETAIL. Shadowserver reports that over 380 SMA1000 appliances remain exposed online.

In addition to the SonicWall exploits, CISA has flagged a high-severity encryption flaw in Apache Tomcat (CVE-2026-34486). This vulnerability allows attackers to bypass encryption protections on clustered traffic. A Chinese-speaking threat actor has been observed using this flaw in AI-assisted campaigns to deploy reverse shells.

Entities

Apache Tomcat · CISA · Shadowserver · SonicWall · Volexity

Sources

CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs | #ransomware | #cybercrime - National Cyber Security Consulting [nationalcybersecurity.com]

7 days ago

CISA confirms SharePoint flaw is now fueling ransomware attacks – 4sysops [4sysops.com]

5 days ago

CISA Warns of SonicWall SMA1000 Vulnerabilities Exploited in Attacks to Deploy Ransomware [cybersecuritynews.com]

6 days ago