SonicWall: 2 Actively-Exploited Flaws Added to CISA KEV
CISA has added two actively-exploited SonicWall vulnerabilities to its Known Exploited Vulnerabilities Catalog, underscoring the immediate threat these flaws pose to organizations.
Key findings
- Two SonicWall vulnerabilities, CVE-2026-15409 and CVE-2026-15410, added to CISA KEV.
- Both flaws are confirmed under active exploitation in the wild.
- Both CVEs are explicitly linked to ransomware campaigns.
- Immediate patching and remediation are critical for all SonicWall users.
- CISA mandates federal agencies to address these KEV-listed vulnerabilities promptly.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert by adding two SonicWall vulnerabilities, CVE-2026-15409 and CVE-2026-15410, to its Known Exploited Vulnerabilities (KEV) Catalog. This addition on July 14, 2026, confirms that these security flaws are under active exploitation in the wild, making them critical targets for immediate remediation by federal agencies and a high priority for all organizations using SonicWall products.
Both CVE-2026-15409 and CVE-2026-15410 are significant security concerns, with CISA specifically flagging both as being associated with ransomware campaigns. This direct link to ransomware operations elevates the risk profile of these vulnerabilities, as successful exploitation could lead to severe business disruption, data exfiltration, and significant financial costs for affected entities. The specific nature of these vulnerabilities has not been fully disclosed, but their presence in the KEV catalog indicates they allow attackers to gain unauthorized access or execute malicious code.
Inclusion in the KEV catalog serves as a definitive signal that these vulnerabilities are not theoretical risks but are actively being leveraged by threat actors. CISA mandates that federal civilian executive branch agencies remediate KEV-listed vulnerabilities within specific deadlines, typically ranging from a few days to several weeks, depending on the severity and nature of the flaw. This urgency reflects the ongoing threat landscape where unpatched, actively exploited vulnerabilities are prime targets for cybercriminals.
Organizations utilizing SonicWall products are strongly advised to identify all affected systems and apply available patches or mitigation strategies without delay. Prioritizing the remediation of CVE-2026-15409 and CVE-2026-15410 is crucial to prevent potential compromise by ransomware groups and other malicious actors. Defenders should also review their network logs for any signs of exploitation attempts and enhance their security monitoring capabilities to detect and respond to suspicious activities promptly.