InfoSecBulletin Cybersecurity for mankind
The CISA in the U.S. has added two important SonicWall SMA1000 flaws—CVE-2026-15409 and CVE-2026-15410-to its list of Known Exploited Vulnerabilities after finding they are used in ransomware attacks.
SonicWall showed the flaws on July 14, 2026, after checking for active use. The issues impact SMA 6210, SMA 7210, and SMA 8200v devices that run the unsafe 12.4.3 or 12.5.0 platform-hotfix versions. SonicWall’s firewall SSL-VPN services and SMA 100 Series products are not affected.
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
WinRAR, WordPress RCE flaw & Zyxel GS1900 Zero-Day exploited in the wild
Daily Cyber security update for 04.11. 2026
Daily Cyber security update for 03.11. 2026
Using ARTEX AI, Hacker to attack 200 Organizations Across 14 Countries
Amadeus cyber incident impacted “Cathay Pacific, Qantas, Japan, Malaysia, Korean & Asiana” Airlines
CVE-2026-15409 is a critical server-side request forgery (SSRF) vulnerability in the SMA1000 Workplace interface, carrying a CVSS score of 10.0. It can be exploited remotely without authentication or user interaction.
CVE-2026-15410, rated CVSS 7.2, is an improper code-generation/code-injection flaw in the Appliance Management Console that can allow an authenticated administrator to execute arbitrary operating-system commands.
Security experts have seen hackers using both weaknesses to get more access and possibly take full control of affected devices. The INC Ransomware operation is said to be connected to this exploitation, while past actions were linked to the threat group UTA0533.
A successful compromise could allow attackers to steal credentials and session data, maintain persistence, move laterally across corporate networks and ultimately deploy ransomware.
SonicWall has put out updated versions 12.4.3-03453 and later, and 12.5.0-02835 and later. The company states that there is no other solution, so it’s very important to patch right away.
Organizations should check affected devices for signs of problems. SonicWall suggests looking at logs for strange requests, hotfix rollbacks, and unauthorized API routes. If a problem is found, defenders should think about re-imaging or redeploying the device, changing admin and user passwords, and resetting TOTP tokens.
Microsoft SharePoint vulnerability
CISA said today that ransomware groups are using a serious Microsoft SharePoint vulnerability that allows remote code execution. This issue has been noted as actively used since early July.
This security flaw is called CVE-2026-45659. It comes from a weakness in handling untrusted data. It lets attackers with low rights run any code on SharePoint servers that haven’t been updated.
It can also be exploited in low-complexity attacks because (as Microsoft explained in May when it released security updates for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition) “an attacker does not require significant prior knowledge of the system and can achieve repeatable success with the payload against the vulnerable component.”
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this problem to its Known Exploited Vulnerabilities Catalog (KEV) on July 1, telling Federal Civilian Executive Branch (FCEB) agencies to fix their servers in three days.
“This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” the U.S. cybersecurity agency warned at the time.
Internet security watchdog group Shadowserver currently tracks over 8,500 Microsoft SharePoint servers exposed online, with over 200 of them unpatched against the CVE-2026-45659 vulnerability.
