InfoSecBulletin Cybersecurity for mankind
The CISA in the U.S. has added two important SonicWall SMA1000 flaws—CVE-2026-15409 and CVE-2026-15410-to its list of Known Exploited Vulnerabilities after finding they are used in ransomware attacks.
SonicWall showed the flaws on July 14, 2026, after checking for active use. The issues impact SMA 6210, SMA 7210, and SMA 8200v devices that run the unsafe 12.4.3 or 12.5.0 platform-hotfix versions. SonicWall’s firewall SSL-VPN services and SMA 100 Series products are not affected.
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
CVE-2026-15409 is a critical server-side request forgery (SSRF) vulnerability in the SMA1000 Workplace interface, carrying a CVSS score of 10.0. It can be exploited remotely without authentication or user interaction.
CVE-2026-15410, rated CVSS 7.2, is an improper code-generation/code-injection flaw in the Appliance Management Console that can allow an authenticated administrator to execute arbitrary operating-system commands.
Security experts have seen hackers using both weaknesses to get more access and possibly take full control of affected devices. The INC Ransomware operation is said to be connected to this exploitation, while past actions were linked to the threat group UTA0533.
A successful compromise could allow attackers to steal credentials and session data, maintain persistence, move laterally across corporate networks and ultimately deploy ransomware.
SonicWall has put out updated versions 12.4.3-03453 and later, and 12.5.0-02835 and later. The company states that there is no other solution, so it’s very important to patch right away.
Organizations should check affected devices for signs of problems. SonicWall suggests looking at logs for strange requests, hotfix rollbacks, and unauthorized API routes. If a problem is found, defenders should think about re-imaging or redeploying the device, changing admin and user passwords, and resetting TOTP tokens.
Microsoft SharePoint vulnerability
CISA said today that ransomware groups are using a serious Microsoft SharePoint vulnerability that allows remote code execution. This issue has been noted as actively used since early July.
This security flaw is called CVE-2026-45659. It comes from a weakness in handling untrusted data. It lets attackers with low rights run any code on SharePoint servers that haven’t been updated.
It can also be exploited in low-complexity attacks because (as Microsoft explained in May when it released security updates for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition) “an attacker does not require significant prior knowledge of the system and can achieve repeatable success with the payload against the vulnerable component.”
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this problem to its Known Exploited Vulnerabilities Catalog (KEV) on July 1, telling Federal Civilian Executive Branch (FCEB) agencies to fix their servers in three days.
“This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” the U.S. cybersecurity agency warned at the time.
Internet security watchdog group Shadowserver currently tracks over 8,500 Microsoft SharePoint servers exposed online, with over 200 of them unpatched against the CVE-2026-45659 vulnerability.
