Loading story…
InfraTrust reported that 14 infrastructure vendors published 61 relevant advisories in the 30 days ending July 17, including 26 remotely reachable vulnerabilities that require no authentication and six advisories rated critical. The review said the highest risk remains concentrated in internet-exposed edge infrastructure such as remote access gateways, firewalls, switches, load balancers, and security appliances, and urged defenders to prioritize remediation based on exposure, reachability, known exploitation, and business importance rather than CVSS scores alone.
The most urgent issues were SonicWall SMA1000 flaws CVE-2026-15409 and CVE-2026-15410, which can be chained for full remote code execution and were added to CISA's Known Exploited Vulnerabilities catalog. The report also highlighted critical Fortinet FortiSandbox command-injection flaws, along with updates affecting Dell EMC Networking OS10, SmartFabric Manager, F5 BIG-IP, and Juniper denial-of-service bugs. For SonicWall and FortiSandbox appliances, the guidance warned that patching may be insufficient after exposure or exploitation and recommended forensic review, credential rotation, session invalidation, and rebuilding appliances where compromise is suspected.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
An infrastructure security review found that 14 infrastructure vendors issued 61 relevant advisories in the 30 days ending July 17. It identified 26 remotely reachable unauthenticated vulnerabilities and six advisories with critical CVSS scores.
CISA added Fortinet FortiSandbox vulnerabilities CVE-2026-39808 and CVE-2026-25089 to the Known Exploited Vulnerabilities catalog after exploitation was detected. Eclypsium highlighted the flaws as unauthenticated command injection issues in FortiSandbox advisories FG-IR-26-100 and FG-IR-26-141.
The InfraTrust report says SonicWall SMA1000 vulnerabilities CVE-2026-15409 and CVE-2026-15410 were added by CISA to the Known Exploited Vulnerabilities catalog. The flaws were highlighted as especially urgent because they can be chained for full remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
5 references tracked. Mallory keeps watching after this page renders.
eclypsium.com
Open sourcecyberaccord.com
Open sourcecybersecuritynews.com
Open sourceeclypsium.com
Open sourcepulse.infra-trust.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SonicWall has patched two vulnerabilities that are being actively exploited against **SMA 1000 Series** appliances, affecting models including **6210, 7210, and 8200v**. The flaws, tracked as **`CVE-2026-15409`** and **`CVE-2026-15410`**, impact multiple **12.4.3** and **12.5.0** platform-hotfix releases. SonicWall described `CVE-2026-15409` as a **critical unauthenticated SSRF** issue in the Appliance Work Place interface and `CVE-2026-15410` as a **high-severity code injection** flaw in the Appliance Management Console that can allow an authenticated administrator to execute arbitrary operating system commands. SonicWall said the vulnerabilities have been exploited together in the wild and released hotfixes to address them. Government and vendor advisories urged organizations to update immediately and investigate appliances for signs of compromise, warning that patching alone may not be sufficient if an appliance has already been breached. SonicWall recommended reviewing logs, re-imaging or re-deploying affected systems where indicators are found, changing user and administrator passwords, and resetting TOTP tokens. The **Canadian Centre for Cyber Security** highlighted the advisory, and **CISA** added both vulnerabilities to its **Known Exploited Vulnerabilities** catalog the same day, underscoring the urgency for defenders to remediate exposed SMA1000 deployments.
Aug 25, 2026
Security monitoring and reporting highlighted escalating attacker focus on internet-exposed edge infrastructure, including **active exploitation** of a maximum-severity Cisco SD-WAN flaw and **large-scale reconnaissance** against SonicWall firewalls. Cisco disclosed **CVE-2026-20127** (CVSS 10.0) affecting *Cisco Catalyst SD-WAN Controller* (vSmart) and *Catalyst SD-WAN Manager* (vManage), describing in-the-wild exploitation dating back to 2023 that enables **unauthenticated authentication bypass** leading to **administrative privileges** via crafted requests; Cisco attributes discovery to **ASD-ACSC** and tracks related activity as **UAT-8616**. Separately, GreyNoise-tracked activity showed a coordinated scanning campaign against **SonicWall SonicOS** devices using **4,000+ unique IPs** to enumerate targets—primarily probing a SonicOS **REST API endpoint** used to determine whether **SSL VPN** is enabled (a common precursor to follow-on credential attacks and exploitation). The campaign generated **84,142 scanning sessions** over a four-day window and was assessed as a continuation/escalation of similar late-2025 scanning that targeted both Palo Alto and SonicWall VPN infrastructure, reinforcing the likelihood of an impending exploitation wave against exposed and unpatched perimeter devices.
Jun 29, 2026
Multiple network security products, including those from Fortinet, SonicWall, Cisco, and WatchGuard, have been actively targeted by threat actors exploiting recently disclosed vulnerabilities. Cisco reported that CVE-2025-20393, a critical flaw in AsyncOS, has been abused by a China-nexus APT group (UAT-9686) to deliver malware such as ReverseSSH, Chisel, AquaPurge, and AquaShell, with the vulnerability remaining unpatched. SonicWall confirmed exploitation of CVE-2025-40602, a local privilege escalation flaw in SMA 100 series appliances, which, when chained with CVE-2025-23006, enables unauthenticated remote code execution with root privileges. These attacks highlight a growing trend of adversaries focusing on firewalls and edge appliances to gain deep visibility into network traffic, VPN connections, and downstream systems. Security researchers and vendors have issued warnings and patches in response to these incidents. Fortinet's FortiGate firewalls are also being exploited via CVE-2025-59718, allowing attackers to bypass authentication and export system configuration files. The rapid exploitation of these vulnerabilities underscores the critical need for organizations to promptly apply security updates and monitor for signs of compromise in their network infrastructure. The incidents reflect a broader shift in attacker tactics, with a focus on exploiting trusted network devices to achieve persistent access and facilitate further malicious activity within targeted environments.
Jun 29, 2026