SonicWall SMA1000 Zero-Days CVE-2026-15409 (Unauthenticated SSRF, CVSS 10.0) and CVE-2026-15410 (Post-Auth Code Injection, CVSS 7.2) Chained for Root Compromise, Actively Exploited

SonicWall SMA1000 Zero-Days CVE-2026-15409 (Unauthenticated (TL-2026-1382) is a critical-severity software vulnerability scored CVSS 10, first published 2026-07-15 and last reviewed 2026-07-22. It is attributed to UTA0533 with low confidence, affects SonicWall SMA1000 (SMA6210), references 2 CVEs (CVE-2026-15409, CVE-2026-15410), maps to 41 MITRE ATT&CK techniques (T1005, T1016, T1021.002), and is covered by 9 detection rules and 44 indicators of compromise.

Key facts for TL-2026-1382

Threat ID
TL-2026-1382
Severity
CRITICAL
CVSS
10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-15
Last reviewed
2026-07-22
Attribution
UTA0533
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, finance, health, technology, managedsecurityservices, criticalinfrastructure
Target regions
North America, Europe, Asia-Pacific, Global
Detection rules
9
Indicators of compromise
44
Updates
2026-07-22 · 4 updates · revalidated 4× · latest source

Rapid7 MDR and SonicWall confirmed active in-the-wild exploitation of two SMA1000 zero-days: an unauthenticated SSRF in the Workplace interface (CVE-2026-15409, CVSS 10.0) chained with a post-authentication code injection in the Appliance Management Console (CVE-2026-15410, CVSS 7.2) to achieve remote OS command execution. Attackers harvested credentials, active sessions, and TOTP MFA seeds from appliance databases, then pivoted into internal Active Directory via the appliance's integrated LDAP service account. Both CVEs were added to CISA KEV with a federal remediation deadline of July 17, 2026.

How SonicWall SMA1000 Zero-Days CVE-2026-15409 (Unauthenticated works

On July 9, 2026, Rapid7's Managed Detection and Response (MDR) team observed active exploitation of two previously unknown vulnerabilities in SonicWall SMA1000 series secure remote access appliances (SMA6210, SMA7210, SMA8200v). SonicWall published a security advisory on July 14, 2026, and both flaws were added to the CISA Known Exploited Vulnerabilities (KEV) catalog on July 15, 2026, triggering Binding Operational Directive (BOD) 26-04 with a federal remediation deadline of July 17, 2026.

The first flaw, CVE-2026-15409 (CVSS 3.1: 10.0, CWE-918 Server-Side Request Forgery), resides in the SMA1000 Appliance Work Place interface and is exploitable by a remote, unauthenticated attacker. The `/wsproxy` websocket-proxy endpoint accepts attacker-controlled `host` and `port` parameters intended for legitimate tunneling. By supplying localhost-bound addresses (0.0.0.0, 127.0.0.1, ::ffff:127.0.0.1), an attacker bypasses network segmentation and reaches internal-only services on the appliance itself, including an Erlang process listening on localhost:1050 that accepts a hardcoded, unauthenticated cookie value. This SSRF is used to reach and authenticate against internal management interfaces that are never meant to be internet-exposed, effectively granting the attacker an authenticated foothold without ever supplying real credentials.

The second flaw, CVE-2026-15410 (CVSS 3.1: 7.2, post-authentication Code Injection in the Appliance Management Console / AMC, reachable via ctrl-service on localhost:8188), allows a remote attacker who holds administrator-level access (obtained via the SSRF pivot or a stolen admin session) to execute arbitrary OS commands as root. The vulnerable code path is the `remove_hotfix` / hotfix-rollback workflow: the hotfix name parameter is insufficiently validated, allowing directory traversal sequences (e.g. `../../../../../tmp/malicious.sh`) that cause the appliance to execute an attacker-planted shell script via `/bin/bash` with root privileges from `/var/lib/aventail/avp/rollback/`, typically as part of a scripted reboot/rollback cycle.

Chained together, CVE-2026-15409 gives an unauthenticated attacker a path to an internal, effectively-authenticated context, and CVE-2026-15410 converts that context into unauthenticated-equivalent root remote code execution on the appliance — despite CVE-2026-15410 nominally requiring authentication. Rapid7 observed post-exploitation activity consistent with a credential-harvesting and lateral-movement playbook: attackers queried and exfiltrated data from appliance session/credential databases (including `/tmp/temp.db*`), harvested cached usernames/passwords and TOTP MFA seed values, and used the appliance's built-in LDAP service-account trust relationship to authenticate directly against the victim's Active Directory environment, generating NTLM logons (Windows Event ID 4624, logon type 3) sourced from the appliance's internal IP with non-standard workstation names (observed example: "kali") that had no corresponding VPN session — a strong host-based indicator that the appliance itself, not a VPN client, was authenticating.

No workarounds exist; SonicWall's guidance is that patching alone is not sufficient for previously-exploited appliances — affected organizations should assume compromise, review logs for the documented indicators, re-image affected appliances, reset all administrator and service-account passwords, and regenerate TOTP MFA seeds. Fixed platform-hotfix releases are 12.4.3-03453 and 12.5.0-02835. Rapid7 has released a Python proof-of-concept for the SSRF and has a Metasploit module in development; vulnerability checks are available in Rapid7 InsightVM, Nexpose, and Exposure Command. Volexity (Sean Koessel, Steven Adair) assisted SonicWall PSIRT (credited discoverer: Adam Babis) with investigation and IOC expansion. No specific threat-actor attribution has been publicly disclosed; targeting is opportunistic against internet-facing SMA1000 appliances across medium-to-large enterprises, multinationals, government agencies, and MSSPs.

MITRE ATT&CK techniques used in TL-2026-1382

Collection

T1005 Data from Local System; T1119 Automated Collection; T1213 Data from Information Repositories

Discovery

T1016 System Network Configuration Discovery; T1046 Network Service Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery

Lateral Movement

T1021.002 SMB/Windows Admin Shares; T1210 Exploitation of Remote Services; T1550.002 Use Alternate Authentication Material: Pass the Hash; T1550.003 Pass the Ticket

Defense Evasion

T1036 Masquerading; T1070 Indicator Removal; T1078 Valid Accounts; T1140 Deobfuscate/Decode Files or Information; T1211 Exploitation for Stealth

Persistence

T1037 Boot or Logon Initialization Scripts; T1505 Server Software Component; T1543 Create or Modify System Process

Credential Access

T1040 Network Sniffing; T1110 Brute Force; T1111 Multi-Factor Authentication Interception; T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials in Files; T1555 Credentials from Password Stores; T1557 Adversary-in-the-Middle

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1090.001 Proxy: Internal Proxy; T1102 Web Service; T1572 Protocol Tunneling

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1489 Service Stop; T1529 System Shutdown/Reboot; T1565 Data Manipulation

Resource Development

T1587.004 Develop Capabilities: Exploits

Reconnaissance

T1595 Active Scanning

Affected products and versions in SonicWall SMA1000 Zero-Days CVE-2026-15409 (Unauthenticated

  • SonicWall — SMA1000 (SMA6210)
    Vulnerable versions: 12.4.3-03245; 12.4.3-03387; 12.4.3-03434; 12.5.0-02283; 12.5.0-02624; 12.5.0-02800
    Fixed in: 12.4.3-03453 (platform-hotfix); 12.5.0-02835 (platform-hotfix)
  • SonicWall — SMA1000 (SMA7210)
    Vulnerable versions: 12.4.3-03245; 12.4.3-03387; 12.4.3-03434; 12.5.0-02283; 12.5.0-02624; 12.5.0-02800
    Fixed in: 12.4.3-03453 (platform-hotfix); 12.5.0-02835 (platform-hotfix)
  • SonicWall — SMA1000 (SMA8200v)
    Vulnerable versions: 12.4.3-03245; 12.4.3-03387; 12.4.3-03434; 12.5.0-02283; 12.5.0-02624; 12.5.0-02800
    Fixed in: 12.4.3-03453 (platform-hotfix); 12.5.0-02835 (platform-hotfix)

Remediation for SonicWall SMA1000 Zero-Days CVE-2026-15409 (Unauthenticated

Patches

  • Upgrade to platform-hotfix 12.4.3-03453 or later
  • Upgrade to platform-hotfix 12.5.0-02835 or later

Immediate actions

  • Emergency patch to platform-hotfix 12.4.3-03453 or 12.5.0-02835 or later on all SMA6210/7210/8200v appliances
  • Treat internet-facing SMA1000 appliances as compromised until forensically cleared, not just patched
  • Review extraweb_access.log for GET requests to /wsproxy containing suspicious host/port parameters (e.g. localhost-bound targets, '=-3389') returning HTTP 101
  • Review ctrl-service.log for remove_hotfix invocations containing path traversal sequences
  • Inspect /var/lib/unit/conf.json for illegitimate routes to /__api__/login or /__api__/logout
  • Check for unexpected presence/access of /tmp/temp.db* session/credential database files
  • Hunt Windows Event ID 4624 logon type 3 (NTLM) originating from the SMA appliance's internal IP with non-VPN-backed workstation names
  • Block the FNS Holdings (ASN 206092) IP ranges at the perimeter if no legitimate business need

Longer-term hardening

  • Re-image or fully redeploy any SMA1000 appliance with indicators of compromise rather than trusting an in-place patch
  • Force password resets for all local administrator and service accounts used by the appliance
  • Regenerate all TOTP MFA seeds tied to the appliance's user base
  • Deploy EDR/host monitoring on domain controllers to catch anomalous NTLM authentications sourced from network-appliance IPs
  • Segment SMA1000 management interfaces (AMC, ctrl-service) from any path reachable via the public Workplace interface
  • Subscribe to SonicWall PSIRT advisories and CISA KEV updates for SMA product line

CVEs associated with SonicWall SMA1000 Zero-Days CVE-2026-15409 (Unauthenticated

CVE-2026-15409, CVE-2026-15410

Weaknesses (CWE) in SonicWall SMA1000 Zero-Days CVE-2026-15409 (Unauthenticated

CWE-918, CWE-94, CWE-22, CWE-306, CWE-269, CWE-77

Timeline of SonicWall SMA1000 Zero-Days CVE-2026-15409 (Unauthenticated

  • Rapid7 MDR later determined that the earliest targeted, in-the-wild exploitation of the SMA1000 SSRF/command-injection chain actually began on this date — roughly three weeks before public disclosure — indicating true zero-day exploitation by a threat actor with pre-existing knowledge of the flaws.
  • A reboot of a second UTA0533-compromised SMA1000 appliance removes memory-resident implant artifacts, complicating forensic reconstruction.
  • Rapid7 reports findings to SonicWall PSIRT; Volexity (Sean Koessel, Steven Adair) assists with investigation and IOC expansion.
  • Rapid7 MDR team first observes active in-the-wild exploitation of unknown SMA1000 vulnerabilities during incident response engagements.
  • Volexity researchers Sean Koessel and Steven Adair assist SonicWall's internal investigation and help identify an additional indicator of compromise, later credited in a vendor advisory update.
  • Regional CERTs (Hong Kong HKCERT, Singapore CSA) issue advisories on the multiple SMA1000 vulnerabilities.
  • SonicWall publishes security advisory SNWLID-2026-0008 disclosing CVE-2026-15409 and CVE-2026-15410, crediting Adam Babis (SonicWall PSIRT) for discovery, and releases patched platform-hotfix firmware 12.4.3-03453 and 12.5.0-02835.
  • CERT-FR publishes alert CERTFR-2026-ALE-006 summarizing the SonicWall SMA1000 advisory for French organizations and recommending forensic review plus full credential/TOTP reset.
  • Rapid7 publicly releases a proof-of-concept exploit (rapid7-CVE-2026-15409) achieving non-root RCE via the Erlang service over the WebSocket tunnel.
  • Widespread security media coverage (BleepingComputer, The Hacker News, SecurityWeek, Help Net Security, and others) amplifies the advisory and urges immediate patching plus forensic review.
  • Rapid7 publishes detailed technical analysis blog post covering the exploit chain, IOCs, and detection guidance; announces a Python PoC and in-development Metasploit module, and ships vulnerability checks in InsightVM, Nexpose, and Exposure Command.
  • CISA sets a federal civilian agency remediation deadline of July 17, 2026 for affected SMA1000 appliances.
  • CISA adds both CVE-2026-15409 and CVE-2026-15410 to the Known Exploited Vulnerabilities catalog, invoking Binding Operational Directive (BOD) 26-04.
  • Additional indicators of compromise and detection guidance for the exploit chain are documented and circulated by security vendors.
  • Volexity publishes full technical analysis attributing the campaign to novel threat actor UTA0533, detailing the ROOTRUN, KNUCKLEBALL, and ORANGETAIL malware toolkit.
  • CISA BOD 26-04 remediation deadline passes for U.S. federal civilian agencies operating affected SMA1000 appliances.

Update history for TL-2026-1382

Sources cited for SonicWall SMA1000 Zero-Days CVE-2026-15409 (Unauthenticated

Threats related to SonicWall SMA1000 Zero-Days CVE-2026-15409 (Unauthenticated

Detection coverage for TL-2026-1382

As of 2026-07-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1382 across Splunk SPL, Microsoft KQL and Sigma, covering 44 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats