InfoSecBulletin Cybersecurity for mankind
The CISA in the U.S. has added two important SonicWall SMA1000 flaws—CVE-2026-15409 and CVE-2026-15410-to its list of Known Exploited Vulnerabilities after finding they are used in ransomware attacks.
SonicWall showed the flaws on July 14, 2026, after checking for active use. The issues impact SMA 6210, SMA 7210, and SMA 8200v devices that run the unsafe 12.4.3 or 12.5.0 platform-hotfix versions. SonicWall’s firewall SSL-VPN services and SMA 100 Series products are not affected.
CISA alerts on multiple PaperCut NG/MF flaws being actively exploited
Fire Ant hackers convert Cisco routers into spy platforms
Five Critical WordPress Flaws Lead to Site Takeover or RCE
700 AI agents united to hack Hugging Face after breaking isolation
ServiceNow warns of three critical security vulnerabilities
100+ Tech and Security Orgs Urge Global Cyber Defense Boost Against AI Threats
8.7 Million Customers data exposed from 3 Airports
Crack 85 Accounts and Steal 2,500+ Records
8-Agent AI Framework Used to Compromise Gov’t Entities in Asia
270+ Zimbra servers compromised in continuous attacks
Singapore Approves 200MW Data-Centre Expansion Under Second Call
CVE-2026-15409 is a critical server-side request forgery (SSRF) vulnerability in the SMA1000 Workplace interface, carrying a CVSS score of 10.0. It can be exploited remotely without authentication or user interaction.
CVE-2026-15410, rated CVSS 7.2, is an improper code-generation/code-injection flaw in the Appliance Management Console that can allow an authenticated administrator to execute arbitrary operating-system commands.
Security experts have seen hackers using both weaknesses to get more access and possibly take full control of affected devices. The INC Ransomware operation is said to be connected to this exploitation, while past actions were linked to the threat group UTA0533.
A successful compromise could allow attackers to steal credentials and session data, maintain persistence, move laterally across corporate networks and ultimately deploy ransomware.
SonicWall has put out updated versions 12.4.3-03453 and later, and 12.5.0-02835 and later. The company states that there is no other solution, so it’s very important to patch right away.
Organizations should check affected devices for signs of problems. SonicWall suggests looking at logs for strange requests, hotfix rollbacks, and unauthorized API routes. If a problem is found, defenders should think about re-imaging or redeploying the device, changing admin and user passwords, and resetting TOTP tokens.
Microsoft SharePoint vulnerability
CISA said today that ransomware groups are using a serious Microsoft SharePoint vulnerability that allows remote code execution. This issue has been noted as actively used since early July.
This security flaw is called CVE-2026-45659. It comes from a weakness in handling untrusted data. It lets attackers with low rights run any code on SharePoint servers that haven’t been updated.
It can also be exploited in low-complexity attacks because (as Microsoft explained in May when it released security updates for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition) “an attacker does not require significant prior knowledge of the system and can achieve repeatable success with the payload against the vulnerable component.”
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this problem to its Known Exploited Vulnerabilities Catalog (KEV) on July 1, telling Federal Civilian Executive Branch (FCEB) agencies to fix their servers in three days.
“This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” the U.S. cybersecurity agency warned at the time.
Internet security watchdog group Shadowserver currently tracks over 8,500 Microsoft SharePoint servers exposed online, with over 200 of them unpatched against the CVE-2026-45659 vulnerability.
