Ransomware Gang Exploited Two SonicWall Security Flaws Before a Fix Existed

Key points

• SonicWall published a security advisory on July 14 covering two critical flaws, CVE-2026-15409 and CVE-2026-15410, in its SMA 1000 Series remote-access appliances.
• CVE-2026-15409 received a perfect 10-out-of-10 severity score and required no password or login to exploit.
• Security firm Rapid7 confirmed on July 17 that attackers connected to the Inc ransomware group had already used both flaws to break into multiple company networks.
• CISA added both flaws to its official list of actively exploited vulnerabilities on July 14.
• SonicWall has released a fix; Rapid7 warns that patching alone is not enough if the device was already broken into.

Criminals linked to a ransomware operation called Inc broke into corporate networks through two security holes in SonicWall networking devices, security firm Rapid7 confirmed last week. They were using the flaws as zero-days: weaknesses exploited before SonicWall knew the problems existed, let alone had a chance to fix them. We first reported the advisories on July 14, when CISA ordered federal agencies to patch or pull the devices by July 17.

The target was SonicWall's SMA 1000 Series, appliances that sit between an organisation's internal network and the public internet, letting employees connect securely from outside the office. Breaking into one hands attackers a foothold inside a company's walls.

How did the hackers get in?

CVE-2026-15409 scored a perfect 10 out of 10 on the Common Vulnerability Scoring System, the standard scale researchers use to measure severity. No username, no password, nothing needed. An outsider could send crafted web requests to the device's login portal, tricking it into reaching internal systems on the attacker's behalf. That technique is called server-side request forgery; here it let criminals execute their own code on the device at the highest permission level possible.

CVE-2026-15410 scored 7.2. It lets someone who already has access to the device's admin panel inject commands directly into the operating system. The two flaws form a chain: the first gets attackers through the front door, the second gives them the keys to every room.

Once inside, the Inc-linked group followed a familiar playbook. They swept up stored passwords, active login session data, and the seed codes used to generate one-time tokens, so they could impersonate legitimate users. From there they moved laterally across corporate networks, targeting domain controllers, the servers that manage authentication across an entire organisation.

Rapid7 told Dark Reading that in most cases it responded to, it stopped the criminals before they could copy files or trigger encryption. In at least one case, ransomware deployed successfully.

Inc is a ransomware-as-a-service operation. A core group builds and rents out ransomware, malicious software that scrambles a victim's files until a payment is made, to affiliated criminal groups who carry out the actual intrusions.

Should you worry if you've already patched?

Installing the patch is not enough on its own if the device was compromised before the fix arrived. Rapid7's Brett Deroche, director of incident response, told Dark Reading that in observed cases attackers who kept access rolled the device back to the unpatched state after the fix was applied, preserving their foothold. "A comprehensive forensic review of the firewall is required to ensure complete eviction," Deroche said.

If your organisation runs SonicWall SMA 1000 appliances, apply the hotfix immediately, then have your security team sweep the device for signs of earlier access. The patch closes the door; it doesn't tell you who was already inside.