[CVE-2026-15409] Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation
volexity.com | vulnerability | CVE-2026-15409 | #zero-day | #vulnerability-research | #threat-intelligence | #apt | #edge-device
Summary
In early July 2026, Volexity was engaged to perform an incident response investigation where it discovered a threat actor had successfully compromised multiple of the customer's SonicWall Secure Mobile Access (SMA) VPN appliances through a chain of multiple zero-day exploits in the devices. The initial compromise was discovered after suspect authentication and lateral movement attempts were observed from the SonicWall SMA devices.
- CVE
- CVE-2026-15409
- Published
- Collected
--- id: 10094 title: "[CVE-2026-15409] Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation" cve: CVE-2026-15409 source_domain: volexity.com source_url: "https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/" published_at: "2026-07-17T22:10:37Z" tags: ["zero-day", "vulnerability-research", "threat-intelligence", "apt", "edge-device"] phying_url: "https://phying.com/item/10094" lang: en --- # [CVE-2026-15409] Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation ## Summary In early July 2026, Volexity was engaged to perform an incident response investigation where it discovered a threat actor had successfully compromised multiple of the customer's SonicWall Secure Mobile Access (SMA) VPN appliances through a chain of multiple zero-day exploits in the devices. The initial compromise was discovered after suspect authentication and lateral movement attempts were observed from the SonicWall SMA devices. ## Intelligence Metadata - **Sources:** volexity.com - **CVE:** CVE-2026-15409 - **Published:** 2026-07-17T22:10:37Z - **Original:** https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/ - **Phying News:** https://phying.com/item/10094