InfoSecBulletin Cybersecurity for mankind
The CISA in the U.S. has added two important SonicWall SMA1000 flaws—CVE-2026-15409 and CVE-2026-15410-to its list of Known Exploited Vulnerabilities after finding they are used in ransomware attacks.
SonicWall showed the flaws on July 14, 2026, after checking for active use. The issues impact SMA 6210, SMA 7210, and SMA 8200v devices that run the unsafe 12.4.3 or 12.5.0 platform-hotfix versions. SonicWall’s firewall SSL-VPN services and SMA 100 Series products are not affected.
AI Finds Nation-State-Level Zoom Flaw in Under 24 Hours, Zero-Click Attack Exposed
Hacker Actively Exploit SonicWall and SharePoint Flaws
Gunra Ransomware Leverage Fortinet VPN Flaws to Evade MFA Obtaining Enterprise Data
Hackers accessed a US defense manufacturer’s Microsoft 365 account via phishing.
Google Play Apps Utilize Stealth Loaders to Spread Anatsa Banking Malware
Bangladeshi org listed “the Gentlemen’ ransomware victim list: CIRT warns
Around 800 Malicious npm Packages Distribute Cross-Platform RAT and Infostealer
Google Chrome 151 Update Fixes 41 Flaws, 6 Critical
Swiss gov.t SharePoint incident compromised 200 accounts
Azad president, Secretary Post Heads to Contest: ISACA Dhaka Chapter Election
CVE-2026-15409 is a critical server-side request forgery (SSRF) vulnerability in the SMA1000 Workplace interface, carrying a CVSS score of 10.0. It can be exploited remotely without authentication or user interaction.
CVE-2026-15410, rated CVSS 7.2, is an improper code-generation/code-injection flaw in the Appliance Management Console that can allow an authenticated administrator to execute arbitrary operating-system commands.
Security experts have seen hackers using both weaknesses to get more access and possibly take full control of affected devices. The INC Ransomware operation is said to be connected to this exploitation, while past actions were linked to the threat group UTA0533.
A successful compromise could allow attackers to steal credentials and session data, maintain persistence, move laterally across corporate networks and ultimately deploy ransomware.
SonicWall has put out updated versions 12.4.3-03453 and later, and 12.5.0-02835 and later. The company states that there is no other solution, so it’s very important to patch right away.
Organizations should check affected devices for signs of problems. SonicWall suggests looking at logs for strange requests, hotfix rollbacks, and unauthorized API routes. If a problem is found, defenders should think about re-imaging or redeploying the device, changing admin and user passwords, and resetting TOTP tokens.
Microsoft SharePoint vulnerability
CISA said today that ransomware groups are using a serious Microsoft SharePoint vulnerability that allows remote code execution. This issue has been noted as actively used since early July.
This security flaw is called CVE-2026-45659. It comes from a weakness in handling untrusted data. It lets attackers with low rights run any code on SharePoint servers that haven’t been updated.
It can also be exploited in low-complexity attacks because (as Microsoft explained in May when it released security updates for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition) “an attacker does not require significant prior knowledge of the system and can achieve repeatable success with the payload against the vulnerable component.”
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this problem to its Known Exploited Vulnerabilities Catalog (KEV) on July 1, telling Federal Civilian Executive Branch (FCEB) agencies to fix their servers in three days.
“This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” the U.S. cybersecurity agency warned at the time.
Internet security watchdog group Shadowserver currently tracks over 8,500 Microsoft SharePoint servers exposed online, with over 200 of them unpatched against the CVE-2026-45659 vulnerability.
