Code injection in SonicWall SMA1000 (CVE-2026-15410) — recorded as used in ransomware campaigns

1What the ransomware flag means

Every KEV entry carries a marker for whether the vulnerability has been confirmed as used in ransomware campaigns. Most entries this site holds are recorded as not known; this one is on the confirmed side. The difference is not a severity rating but a record of how it has actually been used.

Being used in ransomware means there are real cases where intrusion led directly to encryption and business stoppage, which makes the impact concrete for any organization running the same appliance.

2Where a remote access appliance sits

The SMA1000 exists to let people connect securely from outside into internal systems. By its nature such a device faces the internet while also forming a path into the internal network. From an attacker's perspective it is positioned where the outside can reach and the inside can be reached. That structure is why edge appliances keep being targeted as the entry point for ransomware.

3The condition "authenticated as administrator"

The catalog names authentication as administrator as a condition. Needing authentication makes the precondition heavier, but administrator credentials for edge appliances can come from reuse or from previously leaked credentials.

A server-side request forgery in the same appliance (CVE-2026-15409, this one unauthenticated) was added to KEV the same day, so a combination is conceivable — although the catalog says nothing about chaining the two.

4Two entries for one appliance on one day

Another vulnerability in the same appliance entered KEV on the same day as this one. They differ on whether authentication is required, which changes how usable each is to an attacker.

The two could conceivably be combined, though the catalog says nothing about chaining them. Requiring authentication makes the premise heavier here, but administrator credentials for an edge appliance can come from reuse or from leaked credentials.

The deadline is three days from listing, and because updating an edge appliance stops external connections, having a procedure ready to act before the deadline is the practical preparation.