PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2026-15409] UK Council Attack Linked to SonicWall SMA 1000 Campaign

hunt.io | vulnerability | CVE-2026-15409 | #incident-response | #threat-intelligence | #active-directory | #impacket | #sonicwall | #dcsync | #cve-2026-15409
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Hunt.io links a UK council breach to mass exploitation of SonicWall SMA1000 CVE-2026-15409: LDAP credentials from 168 appliances, secretsdump run on-device, DCSync in five AD environments.
CVE
CVE-2026-15409
Published
Collected

Related coverage

vulnerability · volexity.com
Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation
In early July 2026, Volexity was engaged to perform an incident response investigation where it discovered a threat actor had successfully compromised multiple of the customer's SonicWall Secure Mobile Access (SMA) VPN appliances through a chain of multiple zero-day exploits in the devices. The initial compromise was discovered after suspect authentication and lateral movement attempts were observed from the SonicWall SMA devices.
incident · certik.com
PaperTrade BBO Pricing Incident
PaperTrade reported manipulation attempts on 10–11 October 2026 targeting the Hyperliquid best bid and ask (BBO) used to price its synthetic positions. The project acknowledged the attempts on 11 October. The account examined in this analysis withdrew 1,279,106.191184 USDC more than it deposited. PaperTrade settled positions at the instantaneous BBO midpoint, while its profit haircut used a fixed reference notional. This linked large synthetic payouts to an influenceable quote without increasing the haircut percentage as position size grew.
vulnerability · bishopfox.com
SonicWall-CVE-2024-53704: Exploit Details
Bishop Fox explains its CVE-2024-53704 exploit: unauthenticated attackers can hijack active SSL VPN sessions on unpatched SonicWall firewalls and open tunnels without the victim's password. Patch now.
vulnerability · bishopfox.com
SonicWall CVE-2024-53704: SSL VPN Session Hijacking
Exploit details for CVE-2024-53704: Bishop Fox walks through the reverse engineering behind the SSL VPN session-hijacking flaw in unpatched SonicWall devices and urges January 2025 patches.
vulnerability · bishopfox.com
It’s 2024 and Over 178,000 SonicWall Firewalls are Publicly Exploitable
Bishop Fox found 178,637 of 233,984 internet-exposed SonicWall NGFW devices (76%) vulnerable to CVE-2022-22274 and CVE-2023-0656, unauthenticated DoS issues sharing one root cause; upgrade urged.
vulnerability · borghq.io
PHP2Shell CVE-2026-109618: What to Do Right Now
Facing PHP2Shell CVE-2026-109618? Here is what is verified before the 14:00 UTC patch, what remains unconfirmed, and your patch-day checklist.
Back