The Inc ransomware group is actively exploiting two zero-day vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series appliances. Chaining these flaws together grants threat actors root-level capabilities on the affected devices. One of the vulnerabilities, CVE-2026-15409, is a critical server-side request forgery (SSRF) that can lead to arbitrary command execution. Organizations using these appliances must apply patches immediately to prevent compromise.