# SonicWall SMA1000 Zero-Day Vulnerabilities Chained for Full Appliance Compromise (CVE-2026-15409, CVE-2026-15410)

> Attackers chained an unauthenticated critical SSRF (CVE-2026-15409, CVSS 10.0) in the SonicWall SMA1000 WorkPlace websocket proxy with a post-authentication OS command injection flaw (CVE-2026-15410, CVSS 7.2) in the Appliance Management Console to achieve full remote-code-execution compromise of SMA6210/7210/8200v appliances. Rapid7 MDR observed active in-the-wild exploitation from June 22, 2026, roughly three weeks before SonicWall's July 15, 2026 public disclosure; both CVEs were added to CISA KEV on July 14, 2026. Post-compromise activity harvested session/TOTP data and pivoted into on-premises Active Directory, with Rapid7 disrupting attempted data exfiltration and encryption consistent with a ransomware objective.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1396
- **ID:** TL-2026-1396
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-15409, CVE-2026-15410

## Description

In June 2026 SonicWall's own PSIRT and third-party incident responders (Rapid7 MDR, Volexity) identified two zero-day vulnerabilities being actively exploited against SonicWall SMA1000-series Secure Mobile Access appliances (models SMA6210, SMA7210, SMA8200v, and the CMS management console) running hotfix firmware 12.4.3-03245 through 12.4.3-03434 and 12.5.0-02283 through 12.5.0-02800.

The first vulnerability, CVE-2026-15409 (CVSS 3.1: 10.0, CWE-918 Server-Side Request Forgery), lives in the unauthenticated `/wsproxy` websocket-proxy endpoint of the SMA1000 WorkPlace web interface on TCP/443. By supplying attacker-controlled host and port parameters (e.g. `0.0.0.0`, `localhost`, `::ffff:127.0.0.1`, or loopback-mapped IPv4-in-IPv6 notation), a remote unauthenticated attacker forces the appliance to open a TCP tunnel to an internal-only service — most notably the `ctrl-service` administrative API listening on TCP/8188, which is normally reachable only from localhost.

Once tunneled into ctrl-service, the attacker abuses the second vulnerability, CVE-2026-15410 (CVSS 3.1: 7.2, CWE-94 Code Injection), a post-authentication OS command injection in the `remove_hotfix` workflow of the SMA1000 Appliance Management Console. The hotfix-name parameter is insufficiently sanitized, allowing path-traversal sequences (e.g. `../../../../tmp/malicious.sh`) that cause the appliance to execute an attacker-staged shell script as root during the (spoofed) hotfix-removal routine — effectively bypassing the intended administrator-authentication requirement because the SSRF tunnel presents the request as though it originated from localhost. The net effect, per VulnCheck exploit developer Landon Rice, is that "an attacker can go from zero access to a complete system compromise for the affected appliance."

Post-exploitation, observed intrusions harvested `/tmp/temp.db*` session-database files containing active session tokens and TOTP MFA seed material, then used the recovered material and the appliance's built-in LDAP service-account trust relationship to authenticate directly against on-premises Active Directory domain controllers without ever establishing a normal VPN session — producing anomalous Windows Event ID 4624 (logon type 3) logons sourced from the appliance's internal IP and non-inventory workstation names such as "kali". Rapid7 reported that in observed cases it disrupted attacker attempts at data exfiltration and file encryption, assessing the ultimate objective as ransomware deployment; overlapping tradecraft across incidents suggests a single actor or tightly coordinated group, though no named threat-actor or nation-state attribution has been publicly confirmed. Attacker source infrastructure was traced to IP ranges registered to FNS Holdings Limited (ASN 206092), a bulletproof/VPN-style hosting provider.

SonicWall released hotfixes 12.4.3-03453 and 12.5.0-02835 on July 15, 2026 (advisory SNWLID-2026-0008) with no interim workaround available; the company advises forensic review for indicators of compromise and, if found, full re-imaging of appliances and a complete credential/secret reset rather than trusting an in-place patch. CISA's Known Exploited Vulnerabilities catalog listing triggers Binding Operational Directive 26-04, requiring federal civilian agencies to remediate or discontinue use of affected appliances by July 17, 2026. Fewer than 5,000 SMA1000 units globally are estimated to be running the vulnerable configuration.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1059.004 Unix Shell
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1070 Indicator Removal
- T1555 Credentials from Password Stores
- T1111 Multi-Factor Authentication Interception
- T1552.001 Credentials In Files
- T1016 System Network Configuration Discovery
- T1210 Exploitation of Remote Services
- T1021.001 Remote Desktop Protocol
- T1550.001 Application Access Token
- T1078 Valid Accounts
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1572 Protocol Tunneling
- T1090 Proxy
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact

## Sources

- [SonicWall customers under threat as attackers exploit 2 zero-days](https://cyberscoop.com/sonicwall-zero-day-vulnerabilities-exploited/)
- [Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days being Actively Exploited (CVE-2026-15409, CVE-2026-15410)](https://www.rapid7.com/blog/post/etr-rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410/)
- [Product Notice: SMA 1000 Series affected by Multiple Vulnerabilities (SNWLID-2026-0008)](https://www.sonicwall.com/support/notices/product-notice-sma-1000-series-affected-by-multiple-vulnerabilities/kA1VN000001nv6D0AQ)
- [SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now](https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-sma1000-flaws-exploited-in-zero-day-attacks-patch-now/)
- [Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands](https://thehackernews.com/2026/07/two-sonicwall-sma-1000-zero-days.html)
- [SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410)](https://www.helpnetsecurity.com/2026/07/14/sonicwall-sma-attacks-via-cve-2026-15409-cve-2026-15410/)
- [SonicWall Issues Urgent SMA Patch Warning for Two Zero-Day Exploits](https://www.securityweek.com/sonicwall-issues-urgent-sma-patch-warning-for-two-zero-day-exploits/)
- [CVE-2026-15409, CVE-2026-15410: SonicWall SMA 1000 zero-day vulnerabilities exploited in the wild](https://securityboulevard.com/2026/07/cve-2026-15409-cve-2026-15410-sonicwall-sma-1000-zero-day-vulnerabilities-exploited-in-the-wild/)
- [NVD - CVE-2026-15409](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-15409)
- [NVD - CVE-2026-15410](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-15410)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2026-15409](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2026-15410](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15410)
- [CVE-2026-15409, CVE-2026-15410 Hit SonicWall SMA1000](https://thecyberexpress.com/cve-2026-15409-cve-2026-15410-sonicwall/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1396