# The Infrastructure Patch List That Actually Matters: SonicWall, Fortinet, F5, and More Under Active Attack
## The Threat
CVSS scores lie. A 9.8 on an internal database server patched behind five layers of segmentation is meaningfully less dangerous than a 7.4 on a VPN appliance sitting naked on the public internet with default credentials. That gap between theoretical severity and real-world exposure is exactly what Eclypsium's new InfraTrust Pulse report is designed to close — and the inaugural July 2026 edition makes clear that the infrastructure attack surface is more exposed than most organizations realize.
The report, authored by Principal Security Researcher Paul Asadoorian, swept 61 advisories from 14 vendors over a 30-day window. Six landed at critical severity; 26 described vulnerabilities exploitable remotely without authentication. Those aren't abstract statistics. Six of the highlighted flaws are either actively exploited in the wild or have been added to CISA's Known Exploited Vulnerabilities catalog, meaning nation-state actors and ransomware crews aren't waiting on proof-of-concept code to drop.
The context matters here: Russian and Chinese state-sponsored groups — Volt Typhoon and Salt Typhoon foremost among them — have spent the last several years methodically targeting edge devices. Routers, firewalls, VPN concentrators, load balancers. The pattern is consistent. Compromise the perimeter appliance before the vendor knows it's vulnerable, install persistent malware, and dwell quietly. The SonicWall SMA1000 exploitation described in this report followed that script precisely: attackers were deploying custom malware weeks before SonicWall disclosed the flaws publicly.
## Severity and Impact
The report spans multiple advisories. Below are the CVEs Eclypsium explicitly called out as highest priority:
| CVE | Vendor / Product | CVSS | Attack Vector | Authentication Required | Notes |
|---|---|---|---|---|---|
| CVE-2026-15409 | SonicWall SMA1000 | TBD | Network | None | Actively exploited; CISA KEV |
| CVE-2026-15410 | SonicWall SMA1000 | TBD | Network | None | Actively exploited; CISA KEV |
| CVE-2026-39808 | Fortinet FortiSandbox | Critical | Network | None | Unauthenticated command injection; KEV-listed July 16, 2026 |
| CVE-2026-25089 | Fortinet FortiSandbox | Critical | Network | None | Unauthenticated command injection; KEV-listed July 16, 2026 |
| DSA-2026-240 | Dell EMC Networking OS10 / SmartFabric Manager | Critical | Network | None | Remotely exploitable; data-center fabric management |
| Multiple | F5 BIG-IP | High–Critical | Network | None | Unauthenticated, network-reachable |
| Multiple | Juniper networking | High | Network | None | Remote crash / DoS potential |
| Multiple | NVIDIA BlueField / ConnectX | TBD | Local/Network | Varies | DPUs and SmartNICs in AI infrastructure |
*CVSS scores for SonicWall entries had not been formally published at time of reporting. Federal remediation deadline for Fortinet entries: July 19, 2026 under BOD 26-04.*
## Affected Products
SonicWall
Fortinet
Dell Technologies
F5
Juniper Networks
NVIDIA
## Mitigations
Patch immediately — no exceptions:
Patch and validate access controls:
Patch and monitor:
Strategic guidance:
## References
---
## HackWire Analysis
The SonicWall SMA1000 detail buried in this report deserves more attention than it's getting: attackers were exploiting CVE-2026-15409 and CVE-2026-15410 to install custom malware *before SonicWall disclosed the vulnerabilities*. That means the vendor's patch timeline is irrelevant for organizations that were hit during that window. It's zero-day exploitation of remote-access infrastructure, which is exactly the playbook Volt Typhoon and Salt Typhoon have refined over the past three years. The implication for defenders isn't just "patch faster" — it's that remote-access appliances need continuous behavioral monitoring because the patch announcement may come after the breach.
The Fortinet situation reveals a different failure mode: two critical command injection flaws disclosed in April and June sat unpatched long enough that CISA had to formally add them to the KEV catalog in July with a federal deadline. These weren't obscure bugs — they were unauthenticated command injection on an internet-facing sandbox appliance. The gap between "vendor patches available" and "organizations actually applied them" remains the industry's most persistent and lethal problem.
What the InfraTrust Pulse is attempting to solve is real and underserved. Most vulnerability programs treat CVSS 9.x as a universal alarm and CVSS 6.x as a yellow light. That model breaks completely when you're looking at infrastructure. A CVSS 7.5 unauthenticated DoS on a Juniper core switch that can black-hole your entire data center is operationally more dangerous than a CVSS 9.8 requiring local access to a dev workstation. Organizations that don't have an infrastructure-specific lens on their vulnerability management program are flying blind at the perimeter — and that's exactly where state-sponsored actors are shopping.
The NVIDIA BlueField and ConnectX entries are the sleeper story here. DPUs and SmartNICs in AI infrastructure are next-generation attack surfaces that most security teams have no visibility into. As AI compute clusters scale, expect these firmware-level vulnerabilities to get significantly more attacker attention.
— HackWire Editorial
---
## Related Coverage