Sonicwall News Articles

SonicWall SMA zero-days were exploited weeks before disclosure - Help Net Security

CVE-2026-15409 and CVE-2026-15410 were exploited since June 22, 2026, allowing threat actors to install custom malware.

1 week ago

SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access

Ravie LakshmananJul 19, 2026Vulnerability / Network Security

1 week ago

SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access

Volexity links UTA0533 to two SonicWall SMA 1000 zero-days used before disclosure to gain root, plant malware, and capture LDAP credentials.

1 week ago

Week in review: High severity WordPress vulnerabilities, fake OAuth IDs bypass sign-in logs - Help Net Security

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Two new high severity WordPress vulnerabilities, patch

1 week ago

Inc Ransomware Exploits SonicWall SMA Zero-Days

When chained together, the two vulnerabilities allow threat actors to gain root-level capabilities on SonicWall's mobile access appliances.

2 weeks ago

Hackers Actively Exploiting SonicWall SMA1000 0-Day Vulnerability in the Wild - IT Security News

SonicWall disclosed two vulnerabilities affecting its SMA1000 Series remote access appliances, and threat actors were already exploiting one of them before the advisory even went public. The flaws include a critical server-side request forgery (SSRF) bug, CVE-2026-15409, scoring a perfect…Read more ...

2 weeks ago

SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now

SonicWall warns that threat actors have been exploiting two SMA1000 vulnerabilities, tracked as CVE-2026-15409 and CVE-2026-15410, in zero-day attacks and urges customers to install the newly released security updates.

2 weeks ago

Hackers bypass SonicWall VPN MFA due to incomplete patching

Threat actors brute-forced VPN credentials and bypassed multi-factor authentication (MFA) on SonicWall Gen6 SSL-VPN appliances to deploy tools used in ransomware attacks.

SonicWall Edge Access Devices Hit by Zero-Day Attacks

In the attacks against the vendor's SMA1000 line, threat actors chained a new zero-day flaw with a critical vulnerability disclosed earlier this year.

U.S. CISA adds Cisco, SonicWall, and ASUS flaws to its Known Exploited Vulnerabilities catalog

U.S. CISA adds Cisco, SonicWall, and ASUS vulnerabilities to its Known Exploited Vulnerabilities catalog..

Hackers Actively Exploit SonicWall SMA1000 Zero-Day to Escalate Privileges

The vulnerability, a local privilege escalation flaw, allows attackers with access to the management console to gain elevated privileges and potentially take complete control of affected systems.

Hackers Actively Exploit SonicWall SMA1000 Zero-Day to Escalate Privileges

SonicWall has issued an urgent security advisory warning of active exploitation of a local privilege escalation vulnerability affecting its SMA1000 appliances.

Exploited SonicWall zero-day patched (CVE-2025-40602) - Help Net Security

Attackers have been leveraging CVE-2025-40602, a local privilege escalation vulnerability in SonicWall SMA 1000 appliances.

CVE-2025-40602 | Arctic Wolf

SonicWall has released fixes for an actively exploited medium-severity zero-day vulerability in the SonicWall SMA1000 Appliance Management Console, tracked as CVE-2025-40602

SonicWall Fixes Actively Exploited CVE-2025-40602 in SMA 100 Appliances

SonicWall released fixes for an actively exploited SMA 100 vulnerability enabling privilege escalation and chained root access attacks.

Sonicwall warns of new SMA1000 zero-day exploited in attacks

SonicWall warned customers today to patch a vulnerability in the SonicWall SMA1000 Appliance Management Console (AMC) that was chained in zero-day attacks to escalate privileges.

New SonicWall SonicOS flaw allows hackers to crash firewalls

American cybersecurity company SonicWall urged customers today to patch a high-severity SonicOS SSLVPN security flaw that can allow attackers to crash vulnerable firewalls.

Akira Hits SonicWall VPNs in Broad Ransomware Campaign

Akira ransomware actors are currently targeting SonicWall firewall customers vulnerable to a bug discovered last year.

Akira ransomware breaching MFA-protected SonicWall VPN accounts

Ongoing Akira ransomware attacks targeting SonicWall SSL VPN devices continue to evolve, with the threat actors found to be successfully authenticating despite OTP MFA being enabled on accounts. Researchers suspect this may through the use of previously stolen OTP seeds, though the exact method rema...

Akira ransomware exploiting critical SonicWall SSLVPN bug again

The Akira ransomware gang is actively exploiting CVE-2024-40766, a year-old critical-severity access control vulnerability, to gain unauthorized access to SonicWall devices.

SonicWall SSL VPN Flaw and Misconfigurations Actively Exploited by Akira Ransomware Hackers

Akira ransomware exploits SonicWall CVE-2024-40766 with 9.3 CVSS flaw, driving 40 attacks in July 2025.

SonicWall finds no SSLVPN zero-day, links ransomware attacks to 2024 flaw

SonicWall says that recent Akira ransomware attacks exploiting Gen 7 firewalls with SSLVPN enabled are exploiting an older vulnerability rather than a zero-day flaw.

SonicWall Confirms Patched Vulnerability Behind Recent VPN Attacks, Not a Zero-Day

SonicWall confirms recent SSL VPN attacks link to patched CVE-2024-40766 and reused passwords, urging password resets.

SonicWall says recent attack wave involved previously disclosed flaw, not zero-day

The company said it had linked recent hacks to customers’ use of legacy credentials when migrating from Gen 6 to Gen 7 firewalls.

Akira Ransomware Exploits SonicWall SMA100 Vulnerabilities: What You Need to Know | Bitsight

New SonicWall SMA100 vulnerabilities (CVE-2025-40596 to CVE-2025-40599) could enable remote code execution—even on patched devices. While Akira ransomware activ