# SonicWall SMA1000 Zero-Days CVE-2026-15409 (Unauthenticated SSRF, CVSS 10.0) and CVE-2026-15410 (Post-Auth Code Injection, CVSS 7.2) Chained for Root Compromise, Actively Exploited

> Rapid7 MDR and SonicWall confirmed active in-the-wild exploitation of two SMA1000 zero-days: an unauthenticated SSRF in the Workplace interface (CVE-2026-15409, CVSS 10.0) chained with a post-authentication code injection in the Appliance Management Console (CVE-2026-15410, CVSS 7.2) to achieve remote OS command execution. Attackers harvested credentials, active sessions, and TOTP MFA seeds from appliance databases, then pivoted into internal Active Directory via the appliance's integrated LDAP service account. Both CVEs were added to CISA KEV with a federal remediation deadline of July 17, 2026.

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-07-22T04:27:44.948Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1382
- **ID:** TL-2026-1382
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** UTA0533
- **Detections:** 9 · **IOCs:** 44 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-15409, CVE-2026-15410

## Description

On July 9, 2026, Rapid7's Managed Detection and Response (MDR) team observed active exploitation of two previously unknown vulnerabilities in SonicWall SMA1000 series secure remote access appliances (SMA6210, SMA7210, SMA8200v). SonicWall published a security advisory on July 14, 2026, and both flaws were added to the CISA Known Exploited Vulnerabilities (KEV) catalog on July 15, 2026, triggering Binding Operational Directive (BOD) 26-04 with a federal remediation deadline of July 17, 2026.

The first flaw, CVE-2026-15409 (CVSS 3.1: 10.0, CWE-918 Server-Side Request Forgery), resides in the SMA1000 Appliance Work Place interface and is exploitable by a remote, unauthenticated attacker. The `/wsproxy` websocket-proxy endpoint accepts attacker-controlled `host` and `port` parameters intended for legitimate tunneling. By supplying localhost-bound addresses (0.0.0.0, 127.0.0.1, ::ffff:127.0.0.1), an attacker bypasses network segmentation and reaches internal-only services on the appliance itself, including an Erlang process listening on localhost:1050 that accepts a hardcoded, unauthenticated cookie value. This SSRF is used to reach and authenticate against internal management interfaces that are never meant to be internet-exposed, effectively granting the attacker an authenticated foothold without ever supplying real credentials.

The second flaw, CVE-2026-15410 (CVSS 3.1: 7.2, post-authentication Code Injection in the Appliance Management Console / AMC, reachable via ctrl-service on localhost:8188), allows a remote attacker who holds administrator-level access (obtained via the SSRF pivot or a stolen admin session) to execute arbitrary OS commands as root. The vulnerable code path is the `remove_hotfix` / hotfix-rollback workflow: the hotfix name parameter is insufficiently validated, allowing directory traversal sequences (e.g. `../../../../../tmp/malicious.sh`) that cause the appliance to execute an attacker-planted shell script via `/bin/bash` with root privileges from `/var/lib/aventail/avp/rollback/`, typically as part of a scripted reboot/rollback cycle.

Chained together, CVE-2026-15409 gives an unauthenticated attacker a path to an internal, effectively-authenticated context, and CVE-2026-15410 converts that context into unauthenticated-equivalent root remote code execution on the appliance — despite CVE-2026-15410 nominally requiring authentication. Rapid7 observed post-exploitation activity consistent with a credential-harvesting and lateral-movement playbook: attackers queried and exfiltrated data from appliance session/credential databases (including `/tmp/temp.db*`), harvested cached usernames/passwords and TOTP MFA seed values, and used the appliance's built-in LDAP service-account trust relationship to authenticate directly against the victim's Active Directory environment, generating NTLM logons (Windows Event ID 4624, logon type 3) sourced from the appliance's internal IP with non-standard workstation names (observed example: "kali") that had no corresponding VPN session — a strong host-based indicator that the appliance itself, not a VPN client, was authenticating.

No workarounds exist; SonicWall's guidance is that patching alone is not sufficient for previously-exploited appliances — affected organizations should assume compromise, review logs for the documented indicators, re-image affected appliances, reset all administrator and service-account passwords, and regenerate TOTP MFA seeds. Fixed platform-hotfix releases are 12.4.3-03453 and 12.5.0-02835. Rapid7 has released a Python proof-of-concept for the SSRF and has a Metasploit module in development; vulnerability checks are available in Rapid7 InsightVM, Nexpose, and Exposure Command. Volexity (Sean Koessel, Steven Adair) assisted SonicWall PSIRT (credited discoverer: Adam Babis) with investigation and IOC expansion. No specific threat-actor attribution has been publicly disclosed; targeting is opportunistic against internet-facing SMA1000 appliances across medium-to-large enterprises, multinationals, government agencies, and MSSPs.

## MITRE ATT&CK

- T1595 Active Scanning
- T1587.004 Develop Capabilities: Exploits
- T1190 Exploit Public-Facing Application
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1203 Exploitation for Client Execution
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1078 Valid Accounts
- T1111 Multi-Factor Authentication Interception
- T1528 Steal Application Access Token
- T1555 Credentials from Password Stores
- T1552.001 Unsecured Credentials: Credentials in Files
- T1046 Network Service Discovery
- T1016 System Network Configuration Discovery
- T1021.002 SMB/Windows Admin Shares
- T1550.002 Use Alternate Authentication Material: Pass the Hash
- T1005 Data from Local System
- T1213 Data from Information Repositories
- T1090.001 Proxy: Internal Proxy
- T1071.001 Application Layer Protocol: Web Protocols
- T1489 Service Stop
- T1505 Server Software Component
- T1543 Create or Modify System Process
- T1037 Boot or Logon Initialization Scripts
- T1548 Abuse Elevation Control Mechanism
- T1036 Masquerading
- T1070 Indicator Removal
- T1140 Deobfuscate/Decode Files or Information
- T1557 Adversary-in-the-Middle
- T1040 Network Sniffing
- T1110 Brute Force
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1119 Automated Collection
- T1102 Web Service
- T1572 Protocol Tunneling
- T1565 Data Manipulation
- T1057 Process Discovery
- T1210 Exploitation of Remote Services
- T1550.003 Pass the Ticket

## Sources

- [Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero-Days Being Actively Exploited (CVE-2026-15409, CVE-2026-15410)](https://www.rapid7.com/blog/post/etr-rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410)
- [SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now](https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-sma1000-flaws-exploited-in-zero-day-attacks-patch-now/)
- [SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410)](https://www.helpnetsecurity.com/2026/07/14/sonicwall-sma-attacks-via-cve-2026-15409-cve-2026-15410/)
- [Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands](https://thehackernews.com/2026/07/two-sonicwall-sma-1000-zero-days.html)
- [CVE-2026-15409: SonicWall SMA1000 SSRF Vulnerability leading to Unintended Requests](https://cve.halosecurity.com/cve-advisory/cve-2026-15409-sonicwall-sma1000-ssrf-vulnerability-leading-to-unintended)
- [CVE-2026-15409: SonicWall SMA1000 SSRF Vulnerability (CVSS 10.0) Exploited in the Wild](https://securityonline.info/sonicwall-sma1000-ssrf/)
- [Product Notice: SMA 1000 Series affected by Multiple Vulnerabilities](https://www.sonicwall.com/support/notices/product-notice-sma-1000-series-affected-by-multiple-vulnerabilities/kA1VN000001nv6D0AQ)
- [SonicWall Issues Urgent SMA Patch Warning for Two Zero-Day Exploits](https://www.securityweek.com/sonicwall-issues-urgent-sma-patch-warning-for-two-zero-day-exploits/)
- [Critical SonicWall Firewall 0-Day Vulnerabilities Actively Exploited in Attacks](https://cybersecuritynews.com/sonicwall-firewall-0-day-vulnerabilities-exploited/)
- [CVE-2026-15409, CVE-2026-15410 Hit SonicWall SMA1000](https://thecyberexpress.com/cve-2026-15409-cve-2026-15410-sonicwall/)
- [Multiple Vulnerabilities in SonicWall SMA1000 Series](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-088/)
- [SonicWall SMA1000 Series Products Multiple Vulnerabilities](https://www.hkcert.org/security-bulletin/sonicwall-sma1000-series-products-multiple-vulnerabilities_20260715)
- [SonicWall SMA1000 Flaws Actively Exploited for SSRF and Remote Code Execution](https://cyberpress.org/sonicwall-sma1000-flaws/)
- [CISA Known Exploited Vulnerabilities Catalog: CVE-2026-15409](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409)
- [SonicWall PSIRT Advisory SNWLID-2026-0008](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1382