---
id: 10094
title: "[CVE-2026-15409] Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation"
cve: CVE-2026-15409
source_domain: volexity.com
source_url: "https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/"
published_at: "2026-07-17T22:10:37Z"
tags: ["zero-day", "vulnerability-research", "threat-intelligence", "apt", "edge-device"]
phying_url: "https://phying.com/item/10094"
lang: en
---

# [CVE-2026-15409] Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation

## Summary

In early July 2026, Volexity was engaged to perform an incident response investigation where it discovered a threat actor had successfully compromised multiple of the customer's SonicWall Secure Mobile Access (SMA) VPN appliances through a chain of multiple zero-day exploits in the devices. The initial compromise was discovered after suspect authentication and lateral movement attempts were observed from the SonicWall SMA devices.

## Intelligence Metadata

- **Sources:** volexity.com
- **CVE:** CVE-2026-15409
- **Published:** 2026-07-17T22:10:37Z
- **Original:** https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/
- **Phying News:** https://phying.com/item/10094