InfoSecBulletin Cybersecurity for mankind
The CISA in the U.S. has added two important SonicWall SMA1000 flaws—CVE-2026-15409 and CVE-2026-15410-to its list of Known Exploited Vulnerabilities after finding they are used in ransomware attacks.
SonicWall showed the flaws on July 14, 2026, after checking for active use. The issues impact SMA 6210, SMA 7210, and SMA 8200v devices that run the unsafe 12.4.3 or 12.5.0 platform-hotfix versions. SonicWall’s firewall SSL-VPN services and SMA 100 Series products are not affected.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
CVE-2026-15409 is a critical server-side request forgery (SSRF) vulnerability in the SMA1000 Workplace interface, carrying a CVSS score of 10.0. It can be exploited remotely without authentication or user interaction.
CVE-2026-15410, rated CVSS 7.2, is an improper code-generation/code-injection flaw in the Appliance Management Console that can allow an authenticated administrator to execute arbitrary operating-system commands.
Security experts have seen hackers using both weaknesses to get more access and possibly take full control of affected devices. The INC Ransomware operation is said to be connected to this exploitation, while past actions were linked to the threat group UTA0533.
A successful compromise could allow attackers to steal credentials and session data, maintain persistence, move laterally across corporate networks and ultimately deploy ransomware.
SonicWall has put out updated versions 12.4.3-03453 and later, and 12.5.0-02835 and later. The company states that there is no other solution, so it’s very important to patch right away.
Organizations should check affected devices for signs of problems. SonicWall suggests looking at logs for strange requests, hotfix rollbacks, and unauthorized API routes. If a problem is found, defenders should think about re-imaging or redeploying the device, changing admin and user passwords, and resetting TOTP tokens.
Microsoft SharePoint vulnerability
CISA said today that ransomware groups are using a serious Microsoft SharePoint vulnerability that allows remote code execution. This issue has been noted as actively used since early July.
This security flaw is called CVE-2026-45659. It comes from a weakness in handling untrusted data. It lets attackers with low rights run any code on SharePoint servers that haven’t been updated.
It can also be exploited in low-complexity attacks because (as Microsoft explained in May when it released security updates for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition) “an attacker does not require significant prior knowledge of the system and can achieve repeatable success with the payload against the vulnerable component.”
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this problem to its Known Exploited Vulnerabilities Catalog (KEV) on July 1, telling Federal Civilian Executive Branch (FCEB) agencies to fix their servers in three days.
“This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” the U.S. cybersecurity agency warned at the time.
Internet security watchdog group Shadowserver currently tracks over 8,500 Microsoft SharePoint servers exposed online, with over 200 of them unpatched against the CVE-2026-45659 vulnerability.
