CVE-2026-15409

SonicWall SMA1000 Vulnerability Exploited in the Wild

A security warning highlighting a critical SonicWall SMA1000 vulnerability under active exploitation

SonicWall SMA1000 Vulnerability Exploited in the Wild

Do Son October 9, 2026

TL;DR Threat actors are now actively targeting a critical SonicWall SMA1000 vulnerability in the wild. The flaw...

SonicWall SMA 1000 Flaw (CVE-2026-15409) Hits UK Council Diagram of the active SonicWall SMA 1000 campaign and SonicWall SMA 1000 campaign attack flow

Diagram of the active SonicWall SMA 1000 campaign and SonicWall SMA 1000 campaign attack flow

SonicWall SMA 1000 Flaw (CVE-2026-15409) Hits UK Council

Do Son September 11, 2026

At a Glance Category Details Actor or Group Unattributed threat actor (Chinese-language artifacts observed) Activity Type Mass...

SonicWall SMA Zero-Day Chain Roots VPN Appliances and Plants Hidden Malware SonicWall SMA zero-day exploit chain compromising SMA VPN appliances to deploy malware

SonicWall SMA zero-day exploit chain compromising SMA VPN appliances to deploy malware

SonicWall SMA Zero-Day Chain Roots VPN Appliances and Plants Hidden Malware

Do Son July 19, 2026

At a glance Actor / group UTA0533 (Volexity tracking cluster); no nation or identity confirmed Activity type...

SonicWall SMA1000 CVE-2026-15409 (CVSS 10.0) RCE Exploited in the Wild as Public PoC Drops SonicWall SMA1000 vulnerability CVE-2026-15409 remote code execution exploited in the wild

SonicWall SMA1000 vulnerability CVE-2026-15409 remote code execution exploited in the wild

SonicWall SMA1000 CVE-2026-15409 (CVSS 10.0) RCE Exploited in the Wild as Public PoC Drops

Do Son July 16, 2026

TL;DR SonicWall patched a critical SonicWall SMA1000 vulnerability, CVE-2026-15409, on July 14, 2026. Attackers are exploiting it...

📈

EPSS Spike Alerts
Catch risk spikes before they make headlines.

🎯

Custom EPSS/CVSS
Set score thresholds to effectively filter noise.

🛡️

Exploit Intel
Real-world exploit signals beyond the KEV catalog.

🐙

GitHub Issues
Auto-create alert tickets without duplication.

📬

Weekly Digest
Clean summaries, eliminating email spam.

🏷️

Watchlist Groups
Tag vulnerabilities by team (Infra/AppSec/SOC).

🔀

Smart Routing
Route chat channels based on severity levels.

🚨

RBP Tracker
Early warning detection and tracking system.

or try free for 14 days →

CVE-2020-13125CVSS 7.2
An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in...
Watchtower Verified📅 Updated: Oct 25, 2026
CVE-2020-13126CVSS 9.9
An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild...
Watchtower Verified📅 Updated: Oct 25, 2026
CVE-2019-20180CVSS 8.0
The TablePress plugin for WordPress is vulnerable to CSV Injection in versions up to and including 1.14 via...
Watchtower Verified📅 Updated: Oct 25, 2026
CVE-2026-106173CVSS 9.8
A improper limitation of a pathname to a restricted directory (\'path traversal\') vulnerability in Fortinet FortiSIEM 7.5.0 may...
Admin intel📅 Updated: Oct 25, 2026
CVE-2014-125133CVSS 8.7
NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary...
Watchtower Verified📅 Updated: Oct 24, 2026
CVE-2015-20128CVSS 8.8
FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries...
Watchtower Verified📅 Updated: Oct 24, 2026
CVE-2016-20104CVSS 8.7
EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to...
Watchtower Verified📅 Updated: Oct 24, 2026
CVE-2026-110447CVSS 9.2
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in...
CISA KEV📅 Added to KEV: Oct 23, 2026

CVE-2026-20706CVSS 9.1
Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the...
📅 Updated: Oct 25, 2026
CVE-2026-12481CVSS 9.8
A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in...
📅 Updated: Oct 25, 2026
CVE-2026-22547CVSS 9.1
Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model...
📅 Updated: Oct 25, 2026
CVE-2026-25718CVSS 9.1
Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write...
📅 Updated: Oct 25, 2026
CVE-2026-26232CVSS 9.1
Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange.
📅 Updated: Oct 25, 2026
CVE-2026-26247CVSS 9.1
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token...
📅 Updated: Oct 25, 2026
CVE-2026-26292CVSS 9.8
Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations,...
📅 Updated: Oct 25, 2026
CVE-2026-27780CVSS 9.8
Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized...
📅 Updated: Oct 25, 2026