SonicWall SMA1000 SSRF (CVE-2026-15409, CVSS 10.0) Chained With Appliance Management Console Command Injection (CVE-2026-15410, CVSS 7.2) Under Active Zero-Day Exploitation — Threadlinqs Intelligence
As of 2026-07-25, SonicWall SMA1000 SSRF (CVE-2026-15409, CVSS 10.0) Chained With Appliance Management Console Command Injection (CVE-2026-15410, CVSS 7.2) Under Active Zero-Day Exploitation is a critical-severity vulnerability threat attributed to UTA0533, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 45 indicators of compromise.
Threat ID: TL-2026-1390 · Severity: CRITICAL · CVSS: 10 · Status: ACTIVE · Category: VULNERABILITY
Updated: 2026-07-25 · 2 updates · revalidated 2× · latest source
Attribution: UTA0533 · UNKNOWN
Two chained zero-day vulnerabilities in SonicWall SMA1000 secure access appliances (SMA6210, SMA7210, SMA8200v) are under active exploitation: an unauthenticated SSRF in the Workplace websocket proxy
SonicWall disclosed on 2026-07-14 that two vulnerabilities in the SMA1000 series of secure remote access appliances (models SMA6210, SMA7210, SMA8200v, and CMS across all supported hypervisors) are being actively exploited as zero-days, with in-the-wild exploitation confirmed as early as 2026-07-09. CVE-2026-15409 is a critical (CVSS 10.0), unauthenticated server-side request forgery vulnerability in the Workplace interface's websocket proxy handler (`/wsproxy`). By supplying attacker-controlled `host` and `port` parameters (e.g. targeting `localhost:1050`, the port on which the appliance's Erlang management process listens with a hardcoded/well-known cookie), an unauthenticated remote attacker can force the appliance to open a persistent, netcat-like TCP tunnel from the internet-facing interface to arbitrary loopback-only services, exposing internal management surfaces that were never meant to be reachable externally. This SSRF tunnel is the initial-access primitive that removes the authentication requirement normally protecting the appliance's internal Erlang/OTP node and its Appliance Management Console (AMC).
Once a tunnel is established, attackers pivot to CVE-2026-15410, a high-severity (CVSS 7.2) code-injection vulnerability (CWE-94, improper control of generation of code) in the AMC's hotfix-rollback workflow, reachable on port 8188. The `remove_hotfix` handler, invoked via an HTTP POST to `/rollbackConfirm.action` with a `hotfix` parameter, fails to sanitize path-traversal sequences. By supplying a value such as `hotfix=../../../../../tmp/1234.sh`, an attacker can point the rollback routine at an arbitrary attacker-planted script; the AMC executes the referenced file with root privileges as part of its normal (unauthenticated-from-the-tunnel's-perspective) rollback logic, then reboots the device to complete the fake "rollback," masking the compromise as a maintenance event. Chained together, CVE-2026-15409 and CVE-2026-15410 give a remote, unauthenticated attacker full root-level arbitrary command execution on an internet-facing SMA1000 appliance without ever needing valid credentials.
Post-exploitation activity documented across multiple confirmed incidents (investigated by SonicWall PSIRT with support from Rapid7 MDR and Volexity) shows a consistent playbook: attackers systematically extract high-value credentials, active VPN session databases (`/tmp/temp.db*`), and Time-Based One-Time Password (TOTP) MFA seed configurations from the compromised appliance, then use the harvested material to authenticate directly to backend resources — bypassing MFA entirely since the seeds themselves were stolen. Investigators observed subsequent lateral movement into Windows Active Directory environments, including NTLM logons (Windows Event ID 4624) to domain controllers originating from the SMA1000 appliance's IP address, using attacker-supplied workstation names (e.g., "kali") that have no corresponding legitimate VPN session — a strong indicator of credential replay from a non-standard client. Attacker infrastructure was traced to IP ranges associated with a bulletproof/VPN hosting provider (ASN 206092, F.N.S Holdings Limited), consistent with attackers routing exploitation traffic through commercial VPN exit nodes to complicate attribution and blocking.
SonicWall has released platform-hotfix versions 12.4.3-03453 and 12.5.0-02835 (and higher) that remediate both flaws; no workarounds exist, so unpatched, internet-facing SMA1000 appliances remain fully exposed. Given the CVSS 10.0 unauthenticated SSRF entry point, confirmed active exploitation, CISA KEV listing, and evidence of credential/MFA-seed theft plus AD lateral movement in real incidents, organizations running affected SMA1000 firmware should treat any internet-facing, unpatched appliance as presumed-compromised pending forensic review, not merely vulnerable.
Weaknesses (CWE)
CWE-918, CWE-94, CWE-22, CWE-78, CWE-284, CWE-1188
Target sectors: government administration, finance, health, technology, critical-infrastructure, education
Target regions: North America, Europe, Asia-Pacific
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 45 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-15409, CVE-2026-15410, T1190, T1133, T1059, T1068, T1548, T1078, T1070, T1555, T1111, T1110