SonicWall SMA1000 SSRF (CVE-2026-15409, CVSS 10.0) Chained With Appliance Management Console Command Injection (CVE-2026-15410, CVSS 7.2) Under Active Zero-Day Exploitation

SonicWall SMA1000 SSRF (CVE-2026-15409, CVSS 10.0) Chained (TL-2026-1390) is a critical-severity software vulnerability scored CVSS 10, first published 2026-07-15 and last reviewed 2026-07-25. It is attributed to UTA0533 with medium confidence, affects SonicWall SMA1000 (SMA6210), references 2 CVEs (CVE-2026-15409, CVE-2026-15410), maps to 41 MITRE ATT&CK techniques (T1005, T1016, T1018), and is covered by 9 detection rules and 45 indicators of compromise.

Key facts for TL-2026-1390

Threat ID
TL-2026-1390
Severity
CRITICAL
CVSS
10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-15
Last reviewed
2026-07-25
Attribution
UTA0533
Attribution confidence
MEDIUM
Motivation
UNKNOWN
Target sectors
government administration, finance, health, technology, critical-infrastructure, education
Target regions
North America, Europe, Asia-Pacific
Detection rules
9
Indicators of compromise
45
Updates
2026-07-25 · 2 updates · revalidated 2× · latest source

Two chained zero-day vulnerabilities in SonicWall SMA1000 secure access appliances (SMA6210, SMA7210, SMA8200v) are under active exploitation: an unauthenticated SSRF in the Workplace websocket proxy (CVE-2026-15409, CVSS 10.0) that opens a netcat-like tunnel to internal-only services, and a post-authentication path-traversal command injection in the Appliance Management Console's hotfix-rollback workflow (CVE-2026-15410, CVSS 7.2) that executes attacker scripts as root. Both were added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-14, with a federal BOD 26-04 remediation deadline of 2026-07-17; attackers observed in confirmed incidents exfiltrated credentials, session databases, and TOTP MFA seeds and pivoted onto Windows domain controllers.

How SonicWall SMA1000 SSRF (CVE-2026-15409, CVSS 10.0) Chained works

SonicWall disclosed on 2026-07-14 that two vulnerabilities in the SMA1000 series of secure remote access appliances (models SMA6210, SMA7210, SMA8200v, and CMS across all supported hypervisors) are being actively exploited as zero-days, with in-the-wild exploitation confirmed as early as 2026-07-09. CVE-2026-15409 is a critical (CVSS 10.0), unauthenticated server-side request forgery vulnerability in the Workplace interface's websocket proxy handler (`/wsproxy`). By supplying attacker-controlled `host` and `port` parameters (e.g. targeting `localhost:1050`, the port on which the appliance's Erlang management process listens with a hardcoded/well-known cookie), an unauthenticated remote attacker can force the appliance to open a persistent, netcat-like TCP tunnel from the internet-facing interface to arbitrary loopback-only services, exposing internal management surfaces that were never meant to be reachable externally. This SSRF tunnel is the initial-access primitive that removes the authentication requirement normally protecting the appliance's internal Erlang/OTP node and its Appliance Management Console (AMC).

Once a tunnel is established, attackers pivot to CVE-2026-15410, a high-severity (CVSS 7.2) code-injection vulnerability (CWE-94, improper control of generation of code) in the AMC's hotfix-rollback workflow, reachable on port 8188. The `remove_hotfix` handler, invoked via an HTTP POST to `/rollbackConfirm.action` with a `hotfix` parameter, fails to sanitize path-traversal sequences. By supplying a value such as `hotfix=../../../../../tmp/1234.sh`, an attacker can point the rollback routine at an arbitrary attacker-planted script; the AMC executes the referenced file with root privileges as part of its normal (unauthenticated-from-the-tunnel's-perspective) rollback logic, then reboots the device to complete the fake "rollback," masking the compromise as a maintenance event. Chained together, CVE-2026-15409 and CVE-2026-15410 give a remote, unauthenticated attacker full root-level arbitrary command execution on an internet-facing SMA1000 appliance without ever needing valid credentials.

Post-exploitation activity documented across multiple confirmed incidents (investigated by SonicWall PSIRT with support from Rapid7 MDR and Volexity) shows a consistent playbook: attackers systematically extract high-value credentials, active VPN session databases (`/tmp/temp.db*`), and Time-Based One-Time Password (TOTP) MFA seed configurations from the compromised appliance, then use the harvested material to authenticate directly to backend resources — bypassing MFA entirely since the seeds themselves were stolen. Investigators observed subsequent lateral movement into Windows Active Directory environments, including NTLM logons (Windows Event ID 4624) to domain controllers originating from the SMA1000 appliance's IP address, using attacker-supplied workstation names (e.g., "kali") that have no corresponding legitimate VPN session — a strong indicator of credential replay from a non-standard client. Attacker infrastructure was traced to IP ranges associated with a bulletproof/VPN hosting provider (ASN 206092, F.N.S Holdings Limited), consistent with attackers routing exploitation traffic through commercial VPN exit nodes to complicate attribution and blocking.

SonicWall has released platform-hotfix versions 12.4.3-03453 and 12.5.0-02835 (and higher) that remediate both flaws; no workarounds exist, so unpatched, internet-facing SMA1000 appliances remain fully exposed. Given the CVSS 10.0 unauthenticated SSRF entry point, confirmed active exploitation, CISA KEV listing, and evidence of credential/MFA-seed theft plus AD lateral movement in real incidents, organizations running affected SMA1000 firmware should treat any internet-facing, unpatched appliance as presumed-compromised pending forensic review, not merely vulnerable.

MITRE ATT&CK techniques used in TL-2026-1390

Collection

T1005 Data from Local System; T1074.001 Data Staged: Local Data Staging; T1213 Data from Information Repositories

Discovery

T1016 System Network Configuration Discovery; T1018 Remote System Discovery; T1046 Network Service Discovery; T1083 File and Directory Discovery

Lateral Movement

T1021 Remote Services; T1210 Exploitation of Remote Services; T1550 Use Alternate Authentication Material

Defense Evasion

T1036 Masquerading; T1070 Indicator Removal; T1205 Traffic Signaling; T1211 Exploitation for Stealth

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter; T1059.006 Command and Scripting Interpreter: Python; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1090 Proxy; T1090.001 Proxy: Internal Proxy; T1572 Protocol Tunneling; T1573.001 Encrypted Channel: Symmetric Cryptography

Persistence

T1078 Valid Accounts; T1505.003 Server Software Component: Web Shell; T1556 Modify Authentication Process

Initial Access

T1078.002 Valid Accounts: Domain Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application

Credential Access

T1110 Brute Force; T1110.004 Brute Force: Credential Stuffing; T1111 Multi-Factor Authentication Interception; T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1555 Credentials from Password Stores

Impact

T1529 System Shutdown/Reboot; T1531 Account Access Removal

Reconnaissance

T1595 Active Scanning

defense-impairment

T1686 Disable or Modify System Firewall

Affected products and versions in SonicWall SMA1000 SSRF (CVE-2026-15409, CVSS 10.0) Chained

  • SonicWall — SMA1000 (SMA6210)
    Vulnerable versions: 12.4.3-03245; 12.4.3-03387; 12.4.3-03434; 12.5.0-02283; 12.5.0-02624; 12.5.0-02800
    Fixed in: 12.4.3-03453 and higher; 12.5.0-02835 and higher
  • SonicWall — SMA1000 (SMA7210)
    Vulnerable versions: 12.4.3-03245; 12.4.3-03387; 12.4.3-03434; 12.5.0-02283; 12.5.0-02624; 12.5.0-02800
    Fixed in: 12.4.3-03453 and higher; 12.5.0-02835 and higher
  • SonicWall — SMA1000 (SMA8200v)
    Vulnerable versions: 12.4.3-03245; 12.4.3-03387; 12.4.3-03434; 12.5.0-02283; 12.5.0-02624; 12.5.0-02800
    Fixed in: 12.4.3-03453 and higher; 12.5.0-02835 and higher
  • SonicWall — SMA1000 CMS (all hypervisors)
    Vulnerable versions: 12.4.3-03245; 12.4.3-03387; 12.4.3-03434; 12.5.0-02283; 12.5.0-02624; 12.5.0-02800
    Fixed in: 12.4.3-03453 and higher; 12.5.0-02835 and higher

Remediation for SonicWall SMA1000 SSRF (CVE-2026-15409, CVSS 10.0) Chained

Patches

  • Platform-hotfix 12.4.3-03453 and higher (12.4.3 branch)
  • Platform-hotfix 12.5.0-02835 and higher (12.5.0 branch)

Immediate actions

  • Upgrade all SMA1000 series appliances (SMA6210, SMA7210, SMA8200v, CMS) to platform-hotfix 12.4.3-03453 or higher, or 12.5.0-02835 or higher
  • Restrict internet exposure of the SMA1000 Workplace interface (websocket proxy) and Appliance Management Console (port 8188) to trusted management networks only
  • Hunt extraweb_access.log for GET requests containing 'wsproxy' with anomalous host/port parameters and HTTP 101 (switching protocols) responses
  • Hunt ctrl-service.log for /usr/local/bin/remove_hotfix invocations containing path-traversal sequences ('../')
  • Check /var/lib/unit/conf.json for unauthorized/unexpected routes such as /__api__/login or /__api__/logout
  • If compromise indicators are found: treat the appliance as fully compromised, re-image/redeploy from a known-good image rather than trusting in-place remediation

Workarounds

  • None available — SonicWall states there are no mitigations short of patching; disconnect internet-facing SMA1000 appliances that cannot be immediately patched

Longer-term hardening

  • Rotate ALL credentials that could have transited or been stored on the appliance, including local admin and directory-bound service accounts
  • Regenerate all TOTP/MFA seed configurations tied to the appliance's user population
  • Force re-enrollment of MFA for all users who authenticated through the affected SMA1000 during the exposure window
  • Deploy network segmentation so SMA1000 appliances cannot directly reach domain controllers over SMB/RDP/SSH without additional authentication hops
  • Enable centralized, off-appliance log forwarding for extraweb_access.log and ctrl-service.log so logs survive a re-image
  • Monitor for Windows Event ID 4624 NTLM logons to domain controllers originating from SMA1000 appliance IPs with non-standard workstation names

CVEs associated with SonicWall SMA1000 SSRF (CVE-2026-15409, CVSS 10.0) Chained

CVE-2026-15409, CVE-2026-15410

Weaknesses (CWE) in SonicWall SMA1000 SSRF (CVE-2026-15409, CVSS 10.0) Chained

CWE-918, CWE-94, CWE-22, CWE-78, CWE-284, CWE-1188

Timeline of SonicWall SMA1000 SSRF (CVE-2026-15409, CVSS 10.0) Chained

Showing the 20 most recent tracked events.

  • Volexity's incident-response timeline reconstruction shows UTA0533 began actively exploiting the CVE-2026-15409/CVE-2026-15410 chain as early as this date — roughly three weeks before public disclosure, earlier than the previously recorded 2026-07-01 detection.
  • Follow-on Rapid7 reporting indicates MDR first identified unauthenticated exploitation of the (then-unknown) SMA1000 SSRF vulnerability as early as 2026-07-01, predating the previously recorded 2026-07-09 detection date.
  • SonicWall and incident responders (Rapid7 MDR, Volexity) observe the earliest confirmed active exploitation of CVE-2026-15409/CVE-2026-15410 in the wild, prior to public disclosure.
  • Rapid7's Managed Detection and Response team independently detects targeted, active exploitation of internet-facing SMA1000 appliances several days before SonicWall's public advisory, prompting urgent customer notifications and coordination with SonicWall PSIRT.
  • SonicWall clarifies in follow-on reporting that CVE-2026-15409 and CVE-2026-15410 affect only the SMA1000 series (SMA6210, SMA7210, SMA8200v, CMS) and do NOT impact SSL-VPN on SonicWall firewalls or the separate SMA 100 series product line, preventing over-broad remediation scoping.
  • Sophos publishes a blog summarizing the SMA1000 vulnerabilities and active exploitation, citing CTU researcher guidance to identify and patch vulnerable appliances.
  • CISA adds both CVE-2026-15409 and CVE-2026-15410 to the Known Exploited Vulnerabilities (KEV) catalog, triggering Binding Operational Directive 26-04 remediation timelines for federal agencies.
  • SonicWall publishes a product security notice for the SMA 1000 series disclosing CVE-2026-15409 (SSRF, CVSS 10.0) and CVE-2026-15410 (command injection, CVSS 7.2), releasing platform-hotfix 12.4.3-03453 / 12.5.0-02835.
  • SonicWall updates advisory SNWLID-2026-0008 with expanded forensic guidance directing customers to reset TOTP tokens, reset all user/administrator passwords, and re-image compromised appliances from backups predating the vulnerable hotfix.
  • Additional outlets (BleepingComputer, The Hacker News, Help Net Security, SecurityWeek, Security Affairs, The Cyber Express) publish independent coverage confirming active exploitation, reiterating that CVE-2026-15410 requires authenticated administrator access while CVE-2026-15409 is fully unauthenticated, and urging immediate patching.
  • HKCERT publishes a security bulletin for SonicWall SMA1000 series products covering both CVEs.
  • Rapid7 MDR publishes a detailed technical analysis of the exploit chain, including the wsproxy SSRF request format, the rollbackConfirm.action path-traversal payload, and post-exploitation credential/TOTP theft and Active Directory lateral movement observed in customer incidents.
  • Incident responders publish additional attacker asset identifiers, including non-inventory workstation names DESKTOP-KRLUI3J and KALI, and further attacker-controlled IP ranges.
  • A public proof-of-concept exploit for CVE-2026-15409 circulates on GitHub and a Metasploit module is reported under development, raising the risk of broader opportunistic exploitation.
  • Volexity publishes 'Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation,' attributing the campaign to UTA0533, detailing the ROOTRUN/KNUCKLEBALL/Suo5/ORANGETAIL malware set, and releasing YARA detection rules.
  • Deadline for U.S. federal agencies to remediate or disconnect affected SMA1000 appliances under CISA Binding Operational Directive 26-04.
  • Further reporting details the custom malware deployed post-exploitation and confirms exploitation occurred for weeks prior to patch availability.
  • Cybersecurity Dive and other outlets report researchers tracing the earliest observed exploitation to late June 2026.
  • Help Net Security and other outlets continue coverage confirming SMA zero-days were exploited weeks before disclosure.
  • The CTO at NCSC weekly summary references the SonicWall SMA1000 zero-day chain in its week-ending July 26, 2026 roundup.

Update history for TL-2026-1390

Sources cited for SonicWall SMA1000 SSRF (CVE-2026-15409, CVSS 10.0) Chained

Threats related to SonicWall SMA1000 SSRF (CVE-2026-15409, CVSS 10.0) Chained

Detection coverage for TL-2026-1390

As of 2026-07-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1390 across Splunk SPL, Microsoft KQL and Sigma, covering 45 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats