INC Ransomware chains two SonicWall SMA 1000 zero-days to root, and the patch does not evict it
Two flaws in SonicWall SMA 1000 VPN gateways — a CVSS 10 SSRF and a code injection — were exploited as zero-days by INC Ransomware from July 2026. Applying the patch is necessary but not sufficient: attackers roll vulnerable firmware back to keep their foothold.
July 14, 2026. SonicWall publishes a security advisory for two flaws in its SMA 1000 gateways: CVE-2026-15409, a CVSS 10 SSRF, and CVE-2026-15410, a code injection rated 7.2. July 15, 2026. Rapid7 documents active zero-day exploitation. August 2026. INC Ransomware has already posted 885 victims to its leak site, and most applied the patch after being compromised.
For a CISO, that is the costliest reminder of the summer: on an edge appliance, the patch closes the front door but does not remove the intruder already inside.
Two flaws, one chain to root
The graver flaw, CVE-2026-15409, is a server-side request forgery in the appliance’s “Work Place” web interface. An unauthenticated attacker can craft requests that trick the portal into issuing requests on their behalf against internal, normally gated-off services. It requires no authentication and earns the maximum 10 out of 10 CVSS score.
CVE-2026-15410 is a code injection in the Appliance Management Console (AMC). It is rated 7.2 because it assumes you can already reach the console — but once that condition is met, it allows executing commands at the operating system level.
It is the combination that does the damage. SonicWall did not describe the exact chain, but according to Rapid7, the attacker exploits CVE-2026-15409 to establish code execution, then pivots to CVE-2026-15410 to complete the escalation: from an anonymous outsider to root on the gateway. Researchers published a proof-of-concept on GitHub for the first flaw.
What Rapid7 observed
Telemetry published by Rapid7 on July 15, 2026 describes a textbook intrusion flow: the appliances serve as the initial access vector, the flaws allow bypassing input validation and executing commands, then attackers steal credentials, active session databases, and the seeds that generate one-time login codes. From there, they move laterally from compromised SMAs across the corporate network, prioritizing domain controllers.
Two days later, Rapid7 attributed the activity to INC Ransomware, a ransomware-as-a-service group. Brett Deroche, director of incident response at Rapid7, sums up the ground truth: “We have successfully prevented exfiltration and encryption in the majority of cases; however, we now have an active case in which ransomware deployment was achieved.”
The Resecurity report published in early August hammers the point home: INC Ransomware has become the dominant actor on these two flaws, accelerating its activity since the start of August. Affiliates spent most of July 2026 working through internet-exposed SMA 1000 appliances — exploited as zero-days for 22 days before the patch shipped.
Why the patch is not enough
This is the point most coverage misses. Rapid7 observed customers who applied the patch without performing a full forensic review immediately afterward. The result: “We observed the threat actor maintaining persistence and rolling the newly applied patch back to a vulnerable state to maintain access.”
In other words: on an already-compromised appliance, fixing the flaw does not revoke created accounts, stolen sessions, or planted backdoors. The attacker can simply redeploy the vulnerable firmware or lean on existing persistence to stay inside. John Gallagher of Viakoo puts it differently: edge appliances must be treated with an assume-breach mentality, and updates rolled out “in minutes to hours, not weeks to months.”
The surrounding context does not flatter SonicWall. Earlier in 2026, a Texas customer, Marquis Software Solutions, sued the vendor for failing to promptly and accurately inform it of a cyberattack campaign that ended up enabling a ransomware attack against its own customers. The value of an SMA 1000 to an attacker is plain: it is the gateway between the web and the internal network, sold to government agencies, MSSPs, and mid-to-large enterprises — higher-than-average-value targets.
Practically, that means reviewing a patched appliance for the tell-tales Rapid7 documented: a firmware version that does not match the one you deployed, local accounts you never created, and sessions that survive a reboot. All three persist after patching precisely because the patch leaves existing configuration untouched — which is why the correct sequence is patch, then forensics, then a clean reinstall when in doubt.
A precedent that weighs, and a target that does not change
CISA added both flaws to its KEV catalog on July 14, 2026, which triggers a binding remediation deadline for U.S. federal agencies — and serves as a de facto priority everywhere else. The KEV catalog is not a list of curiosities: it is the strongest signal available, “someone is exploiting this right now.”
SonicWall has been here before. Specialized press notes that the vendor takes zero-days on its products at a rate comparable to Fortinet or Ivanti — the three share the same profile: edge appliances, exposed to the internet, sold to agencies and enterprises. For an attacker, that is the ideal combination: a public front door, high privileges, and a target that almost never reboots. When the patch arrives after 22 days of active exploitation, the operational response can no longer depend on vendor reactivity alone.
What to do
The response unfolds in three steps, in order.
Patch first. SonicWall’s fixed release closes both flaws. If your appliance is internet-exposed and unpatched, this is an absolute emergency: CVE-2026-15409 requires no authentication.
Then evict. A patch applied to a compromised appliance removes nothing. You need a full forensic review — local accounts, sessions, TOTP seeds, firmware, outbound access — and a reset of stolen secrets. Rapid7’s rule is unambiguous: without a forensic review, assume the attacker is still there.
Finally restrict. An SMA 1000 has no business being reachable from the whole internet. Put it behind source-address restrictions or an admin VPN, and segment its access to the internal network to limit the blast radius of a pivot toward domain controllers.
Verdict
If you run a SonicWall SMA 1000, two realities apply. First: CVE-2026-15409 is an unauthenticated CVSS 10, actively exploited and tied to a ransomware group — fix it today, not at the next maintenance window. Second: on an edge appliance, the patch is a prerequisite, never a conclusion. Without a forensic review and secret rotation, you have closed a door the attacker has already walked through.
If you do not use SonicWall, the underlying signal holds for every remote-access gateway: the time between a vendor advisory and mass exploitation has collapsed, and a compromised edge appliance endangers the whole internal network. The winning posture is two moves — patch fast, then prove the intruder is gone.
References
- Dark Reading — INC Ransomware Exploits SonicWall SMA Zero-Days, Nate Nelson, July 17, 2026
- Rapid7 — SonicWall SMA1000 Zero-Days Actively Exploited (CVE-2026-15409, CVE-2026-15410), July 15, 2026
- SonicWall PSIRT — SNWLID-2026-0008, July 14, 2026
- The Hacker News — INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws, August 3, 2026
- CISA — Known Exploited Vulnerabilities Catalog, accessed August 20, 2026