SonicWall

Huntress researchers identified a credential stuffing campaign targeting SonicWall VPN and firewall accounts, compromising 30 organizations in two days and 92 accounts in 41 hours. The attacks, which ceased abruptly, may involve pre-positioning for future intrusions, with attackers using valid credentials obtained through unknown means. SonicWall is investigating, while CISA has cataloged 17 exploited vulnerabilities in its products since 2021, including those linked to ransomware campaigns.

Two vulnerabilities in SonicWall SMA1000 were exploited in zero-day attacks for weeks, enabling threat actors to install custom malware on vulnerable VPN appliances. The flaws were recently disclosed but were used before patches were available.

This week's security vulnerabilities include WordPress Remote Code Execution, SonicWall 0-Days, AI service attacks, and a SharePoint 0-Day, leading to code execution, memory loss, stolen keys, and disabled security tools. The issues stemmed from exposed systems, weak checks, old drivers, fake prompts, and public code used for malware delivery.

Inc Ransomware exploits two zero-day vulnerabilities in SonicWall's mobile access appliances, enabling threat actors to gain root-level capabilities when the vulnerabilities are chained together.

SonicWall disclosed two zero-day vulnerabilities (CVE-2026-15409 and CVE-2026-15410) being exploited to compromise SMA1000 appliances, with attackers likely targeting ransomware. The vulnerabilities, chained for full system access, were first exploited on June 22, and SonicWall has released patches and mitigation tools.

SonicWall has warned of active exploitation of two zero-day vulnerabilities in Secure Mobile Access (SMA) 1000 series appliances, one of which could allow arbitrary command execution. The first vulnerability, CVE-2026-15409, is a server-side request forgery (SSRF) flaw exploitable by unauthenticated attackers.

Hackers have bypassed SonicWall VPN multi-factor authentication due to incomplete patching, allowing them to brute-force credentials and deploy ransomware tools. This vulnerability affects SonicWall Gen6 SSL-VPN appliances. Threat actors are exploiting this weakness to launch attacks.

The ThreatsDay Bulletin highlights multiple cybersecurity threats, including a Microsoft Defender 0-Day vulnerability, a SonicWall brute-force attack, and a 17-year-old Excel remote code execution (RCE) flaw. The article emphasizes the persistence of ancient vulnerabilities, supply chain risks, and creative hacking tactics.