CVERaaSnetworkransomware

SonicWall SMA 1000 CVE-2026-15409: A CVSS 10.0 Flaw Exploited by INC Ransomware

Name: CleanIssue
Price range: €€

Published on 2026-08-126 min readCleanIssue

> TL;DR: CVE-2026-15409 (CVSS 10.0) is an unauthenticated server-side request forgery (SSRF) flaw affecting SonicWall SMA 1000 VPN gateways. Chained with CVE-2026-15410 (code injection, CVSS 7.2), it enables root-level command execution, fully bypassing authentication. The INC ransomware group has been exploiting this zero-day since early August 2026 to compromise organizations worldwide, claiming over 885 victims.

The attack chain

Unauthenticated SSRF (CVE-2026-15409): the attacker forces the appliance to make requests toward internal-only services normally unreachable from the outside.

Code injection / path traversal (CVE-2026-15410): combined with the SSRF, it enables arbitrary system command execution with root privileges.

Credential and MFA seed theft: once root, attackers harvest privileged credentials, VPN session tokens, and even TOTP MFA seeds — giving them persistent access that survives a simple password reset.

Persistence tooling: a Python script (dubbed KNUCKLEBALL) launches an open-source HTTP proxy (Suo5) and a custom Java web shell (ORANGETAIL) to maintain access.

Why stealing MFA seeds changes everything

The most critical part of this attack isn't the initial access, but the exfiltration of TOTP seeds. Unlike a password, resetting an MFA seed requires reconfiguring every user's authenticator app individually. A simple password change after an incident is not enough: if the seeds were stolen, the attacker can keep generating valid MFA codes even after password rotation.

What to do

Update immediately to firmware 12.4.3-03453 or 12.5.0-02835 (or later).

Re-image compromised appliances rather than just patching — a patch alone doesn't remove any persistence already installed.

Reset all credentials AND all MFA/TOTP seeds, not just passwords.

Hunt for indicators of compromise: suspicious requests to /__api__/login or /wsproxy, unexpected changes to configuration files.

The lesson for any internet-facing infrastructure

A VPN gateway is, by design, exposed to the internet and meant to be a legitimate entry point into the internal network. An unauthenticated flaw at this level grants near-total access with minimal effort. For any SaaS vendor exposing network infrastructure components (VPNs, gateways, load balancers), the same principle documented in our guide to TLS/DNS/BGP network flaws applies: these components deserve an audit and patch cycle just as rigorous as the application itself, since they're often the very first link in the attack chain.

What CleanIssue checks for

Our audits cover the exposure of internet-facing network infrastructure components, and test the robustness of MFA against a secrets-theft scenario, not just its mere presence.

Key takeaways

An unauthenticated SSRF on an exposed network component can escalate into a full root compromise in just a few steps.

Stolen MFA/TOTP seeds render a simple password rotation ineffective — an incident response plan must cover full MFA secret resets.

Patching after an incident is not enough: re-imaging compromised systems removes persistence that a patch alone won't.

Building HR, payroll, or recruiting software? CleanIssue performs security audits for HR SaaS in real-world conditions, no source code access needed. For a first read of your exposure, start with an external review of your application.

Three adjacent analyses to keep exploring the same attack surface.

Threat actorsransomware

Cl0p, LockBit, ALPHV: The Modern Ransomware Ecosystem in 2026

Mapping the ransomware ecosystem in 2026: the RaaS model, major groups, their tactics, and the evolution toward pure extortion.

2026-04-11 · 8 min read

CVEAPT

VMware vCenter CVE-2026-59310: China-Linked APT Exploits Critical Flaw, France in the Top 5 Victims

CVE-2026-59310 (CVSS 9.8), a path traversal flaw in VMware vCenter, has been exploited by a suspected China-nexus actor to deploy backdoors and a Babuk-derived ransomware. 361 compromised IPs across 47 countries, including 25 in France.

2026-08-18 · 6 min read

CVEAI & LLM

Microsoft IKE CVE-2026-33824: When an Autonomous AI Drives the Exploitation Campaign

CVE-2026-33824 (CVSS 9.8), a double-free flaw in Microsoft's IKE service, was exploited as part of a hacking campaign driven by the DeepSeek AI model via the Hermes Agent framework, targeting over 460 organizations largely autonomously.

2026-08-18 · 6 min read

Sources

Written by CleanIssue

Reviewed on 2026-08-12

Related services

If this topic maps to a real risk in your stack, these are the most relevant CleanIssue audits.

Full Audit

Document all priority flaws and get a real remediation plan.

External Review

Get a fast, clear read on your product’s real external exposure.