# SonicWall SMA1000 SSRF (CVE-2026-15409, CVSS 10.0) Chained With Appliance Management Console Command Injection (CVE-2026-15410, CVSS 7.2) Under Active Zero-Day Exploitation

> Two chained zero-day vulnerabilities in SonicWall SMA1000 secure access appliances (SMA6210, SMA7210, SMA8200v) are under active exploitation: an unauthenticated SSRF in the Workplace websocket proxy (CVE-2026-15409, CVSS 10.0) that opens a netcat-like tunnel to internal-only services, and a post-authentication path-traversal command injection in the Appliance Management Console's hotfix-rollback workflow (CVE-2026-15410, CVSS 7.2) that executes attacker scripts as root. Both were added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-14, with a federal BOD 26-04 remediation deadline of 2026-07-17; attackers observed in confirmed incidents exfiltrated credentials, session databases, and TOTP MFA seeds and pivoted onto Windows domain controllers.

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-07-25T12:23:32.500Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1390
- **ID:** TL-2026-1390
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** UTA0533
- **Detections:** 9 · **IOCs:** 45 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-15409, CVE-2026-15410

## Description

SonicWall disclosed on 2026-07-14 that two vulnerabilities in the SMA1000 series of secure remote access appliances (models SMA6210, SMA7210, SMA8200v, and CMS across all supported hypervisors) are being actively exploited as zero-days, with in-the-wild exploitation confirmed as early as 2026-07-09. CVE-2026-15409 is a critical (CVSS 10.0), unauthenticated server-side request forgery vulnerability in the Workplace interface's websocket proxy handler (`/wsproxy`). By supplying attacker-controlled `host` and `port` parameters (e.g. targeting `localhost:1050`, the port on which the appliance's Erlang management process listens with a hardcoded/well-known cookie), an unauthenticated remote attacker can force the appliance to open a persistent, netcat-like TCP tunnel from the internet-facing interface to arbitrary loopback-only services, exposing internal management surfaces that were never meant to be reachable externally. This SSRF tunnel is the initial-access primitive that removes the authentication requirement normally protecting the appliance's internal Erlang/OTP node and its Appliance Management Console (AMC).

Once a tunnel is established, attackers pivot to CVE-2026-15410, a high-severity (CVSS 7.2) code-injection vulnerability (CWE-94, improper control of generation of code) in the AMC's hotfix-rollback workflow, reachable on port 8188. The `remove_hotfix` handler, invoked via an HTTP POST to `/rollbackConfirm.action` with a `hotfix` parameter, fails to sanitize path-traversal sequences. By supplying a value such as `hotfix=../../../../../tmp/1234.sh`, an attacker can point the rollback routine at an arbitrary attacker-planted script; the AMC executes the referenced file with root privileges as part of its normal (unauthenticated-from-the-tunnel's-perspective) rollback logic, then reboots the device to complete the fake "rollback," masking the compromise as a maintenance event. Chained together, CVE-2026-15409 and CVE-2026-15410 give a remote, unauthenticated attacker full root-level arbitrary command execution on an internet-facing SMA1000 appliance without ever needing valid credentials.

Post-exploitation activity documented across multiple confirmed incidents (investigated by SonicWall PSIRT with support from Rapid7 MDR and Volexity) shows a consistent playbook: attackers systematically extract high-value credentials, active VPN session databases (`/tmp/temp.db*`), and Time-Based One-Time Password (TOTP) MFA seed configurations from the compromised appliance, then use the harvested material to authenticate directly to backend resources — bypassing MFA entirely since the seeds themselves were stolen. Investigators observed subsequent lateral movement into Windows Active Directory environments, including NTLM logons (Windows Event ID 4624) to domain controllers originating from the SMA1000 appliance's IP address, using attacker-supplied workstation names (e.g., "kali") that have no corresponding legitimate VPN session — a strong indicator of credential replay from a non-standard client. Attacker infrastructure was traced to IP ranges associated with a bulletproof/VPN hosting provider (ASN 206092, F.N.S Holdings Limited), consistent with attackers routing exploitation traffic through commercial VPN exit nodes to complicate attribution and blocking.

SonicWall has released platform-hotfix versions 12.4.3-03453 and 12.5.0-02835 (and higher) that remediate both flaws; no workarounds exist, so unpatched, internet-facing SMA1000 appliances remain fully exposed. Given the CVSS 10.0 unauthenticated SSRF entry point, confirmed active exploitation, CISA KEV listing, and evidence of credential/MFA-seed theft plus AD lateral movement in real incidents, organizations running affected SMA1000 firmware should treat any internet-facing, unpatched appliance as presumed-compromised pending forensic review, not merely vulnerable.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1078 Valid Accounts
- T1070 Indicator Removal
- T1555 Credentials from Password Stores
- T1111 Multi-Factor Authentication Interception
- T1110 Brute Force
- T1016 System Network Configuration Discovery
- T1021 Remote Services
- T1213 Data from Information Repositories
- T1572 Protocol Tunneling
- T1090 Proxy
- T1529 System Shutdown/Reboot
- T1528 Steal Application Access Token
- T1036 Masquerading
- T1595 Active Scanning
- T1203 Exploitation for Client Execution
- T1018 Remote System Discovery
- T1046 Network Service Discovery
- T1205 Traffic Signaling
- T1005 Data from Local System
- T1041 Exfiltration Over C2 Channel
- T1550 Use Alternate Authentication Material
- T1078.002 Valid Accounts: Domain Accounts
- T1059.006 Command and Scripting Interpreter: Python
- T1505.003 Server Software Component: Web Shell
- T1556 Modify Authentication Process
- T1211 Exploitation for Stealth
- T1686 Disable or Modify System Firewall
- T1552.001 Unsecured Credentials: Credentials In Files
- T1110.004 Brute Force: Credential Stuffing
- T1083 File and Directory Discovery
- T1210 Exploitation of Remote Services
- T1074.001 Data Staged: Local Data Staging
- T1090.001 Proxy: Internal Proxy
- T1071.001 Application Layer Protocol: Web Protocols
- T1573.001 Encrypted Channel: Symmetric Cryptography

## Sources

- [SonicWall SMA1000 vulnerabilities in active exploitation](https://www.sophos.com/en-us/blog/sonicwall-sma1000-vulnerabilities-in-active-exploitation)
- [SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now](https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-sma1000-flaws-exploited-in-zero-day-attacks-patch-now/)
- [Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands](https://thehackernews.com/2026/07/two-sonicwall-sma-1000-zero-days.html)
- [SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410)](https://www.helpnetsecurity.com/2026/07/14/sonicwall-sma-attacks-via-cve-2026-15409-cve-2026-15410/)
- [Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days being Actively Exploited](https://www.rapid7.com/blog/post/etr-rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410/)
- [SonicWall Issues Urgent SMA Patch Warning for Two Zero-Day Exploits](https://www.securityweek.com/sonicwall-issues-urgent-sma-patch-warning-for-two-zero-day-exploits/)
- [Product Notice: SMA 1000 Series affected by Multiple Vulnerabilities](https://www.sonicwall.com/support/notices/product-notice-sma-1000-series-affected-by-multiple-vulnerabilities/kA1VN000001nv6D0AQ)
- [SonicWall SMA1000 Series Products Multiple Vulnerabilities](https://www.hkcert.org/security-bulletin/sonicwall-sma1000-series-products-multiple-vulnerabilities_20260715)
- [SonicWall warns of active exploitation of two SMA 1000 zero-days](https://securityaffairs.com/195364/hacking/sonicwall-warns-of-active-exploitation-of-two-sma-1000-zero-days.html)
- [CVE-2026-15409, CVE-2026-15410 Hit SonicWall SMA1000](https://thecyberexpress.com/cve-2026-15409-cve-2026-15410-sonicwall/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1390