Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

CISA KEV catalog addition for SonicWall SMA 1000 flaws

Public Sector Action
First reported
Last updated
Happening score
H score 34
1 unique sources, 1 articles

Summary

Hide ▲

CISA added CVE-2026-15409 and CVE-2026-15410 affecting SonicWall SMA 1000 appliances to the KEV catalog, turning the flaws into a federal remediation priority for FCEB agencies. The directive requires those agencies to apply the fixes by July 17, 2026 after reports of active exploitation. The action escalates the vulnerabilities from vendor disclosure to a mandatory government tracking and remediation item.

Related Happenings

US government Gold Eagle vulnerability management launch

Public Sector Action
H score29 First: 16.07.2026 11:50 Last: 16.07.2026 11:50 Sources 1

About this happening: The US government launched Gold Eagle to coordinate vulnerability management and speed exploit detection and remediation across government and private-sector defen...

Open Happening

CISA BOD 26-04 SharePoint remediation deadline

Public Sector Action
H score77 First: 15.07.2026 12:44 Last: 15.07.2026 12:44 Sources 1

About this happening: CISA gave federal agencies until July 17 to secure or discontinue SharePoint servers affected by CVE-2026-56164, turning the remediation deadline into a mandatory...

Open Happening

SonicWall SMA1000 SSRF and code injection flaws (multiple vulnerabilities)

Vulnerability
H score48 First: 15.07.2026 00:23 Last: 15.07.2026 00:23 Sources 1

How related: SonicWall has warned of active exploitation of two zero-day vulnerabilities impacting Secure Mobile Access (SMA) 1000 series appliances, one of which could be exploited to achieve arbitrary command execution.

About this happening: SonicWall SMA1000 vulnerabilities CVE-2026-15409 and CVE-2026-15410 were exploited as zero-days against SMA1000 Secure Mobile Access appliances, with SonicWall...

Latest development: 19.07.2026 16:18

UTA0533 abused CVE-2026-15409 and CVE-2026-15410 against SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances on June 22, 2026, writing /usr/bin/xzfind as ROOTRUN and /usr/lib/python3.11/site-packages/deploy_new.py as KNUCKLEBALL to establish persistence, inject Suo5 and ORANGETAIL, and escalate to root on the compromised appliances.

Open Happening

SonicWall security patch release for CVE-2026-15409

Security Patch Release
H score54 First: 15.07.2026 00:23 Last: 15.07.2026 00:23 Sources 1

How related: The patches are available in the following versions -

About this happening: SonicWall released hotfix security updates for SMA1000 appliances after confirming active exploitation of CVE-2026-15409 and CVE-2026-15410. The fixes are availabl...

Open Happening

CISA KEV order for FCEB agencies on LiteSpeed cPanel flaw

Public Sector Action
H score36 First: 16.06.2026 13:47 Last: 16.06.2026 13:47 Sources 1

About this happening: CISA added the LiteSpeed cPanel user-end plugin flaw to KEV and ordered Federal Civilian Executive Branch agencies to secure systems within three days under ...

Open Happening

Timeline

  1. 15.07.2026 08:30 2 articles · 13d ago

    CISA adds SonicWall SMA 1000 flaws to the KEV catalog

    Legal Policy Action Update

    CISA added CVE-2026-15409 and CVE-2026-15410 to its Known Exploited Vulnerabilities catalog after SonicWall said it was seeing active exploitation of the Secure Mobile Access (SMA) 1000 series appliances. SonicWall urged customers to apply platform-hotfix fixes, review systems for indicators of compromise such as suspicious requests in extraweb_access.log and malformed routes in /var/lib/unit/conf.json, and re-image or redeploy affected appliances if those indicators are present. The catalog action requires Federal Civilian Executive Branch agencies to apply the fixes by July 17, 2026.

    Show sources
    Open in new tab