# Actively Exploited SonicWall SMA1000 Zero-Days (CVE-2026-15409, CVE-2026-15410) Chained for Full Appliance Takeover Alongside Microsoft July 2026 Patch Tuesday (570 CVEs, 3 Zero-Days incl. SharePoint & AD FS EoP)

> SonicWall disclosed and patched two actively exploited SMA1000 zero-days — a pre-auth CVSS 10.0 SSRF (CVE-2026-15409) chained with a post-auth path-traversal code injection (CVE-2026-15410) — that attackers used to gain root on internet-facing appliances, harvest credentials/TOTP seeds, and pivot into Active Directory. Concurrently, Microsoft's record-breaking July 2026 Patch Tuesday fixed 570 vulnerabilities including two actively exploited zero-days (SharePoint Server CVE-2026-56164, AD FS CVE-2026-56155) and one publicly disclosed BitLocker bypass (CVE-2026-50661), a volume Microsoft attributes to its new AI-powered vulnerability-discovery tooling.

- **Published:** 2026-07-17T00:00:00Z
- **Last reviewed:** 2026-07-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1451
- **ID:** TL-2026-1451
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-15409, CVE-2026-15410, CVE-2026-56164, CVE-2026-56155, CVE-2026-50661

## Description

This threat bundles two concurrent, high-severity vendor patch events from mid-July 2026 that both demand urgent perimeter and identity-infrastructure remediation.

SonicWall SMA1000: Rapid7 MDR observed active, targeted exploitation of internet-facing SMA1000-series appliances (models 6210, 7210, 8200v) beginning as early as late June 2026, with confirmed exploitation activity from July 9, 2026. Attackers chain two flaws. CVE-2026-15409 (CVSS 10.0) is a server-side request forgery in the WorkPlace websocket proxy feature (/wsproxy, port 443) that lets an unauthenticated remote attacker supply a localhost-pointing host value, causing the appliance to reach less-hardened internal-only services — notably an Erlang process listening on localhost:1050 — without any credentials. Once that internal foothold is established, CVE-2026-15410 is a post-authentication path-traversal / code-injection vulnerability in the remove_hotfix workflow of the ctrl-service (port 8188, Appliance Management Console); supplying a malicious hotfix path containing directory-traversal sequences (e.g. ../../../../../../tmp/payload.sh) causes the AMC to execute the attacker's script as root. SonicWall confirmed there is no workaround — only patching remediates. Post-compromise, threat actors harvested high-value credentials, active VPN session databases, and TOTP MFA seed configurations from the appliance, then used those credentials to move laterally, including anomalous VPN-less Active Directory authentications against core domain controllers originating from the appliance's internal IP address — effectively using the SMA1000 as an undetected backdoor into the internal AD environment. CISA added both CVEs to the KEV catalog with a July 17, 2026 FCEB remediation deadline. Patched versions: 12.4.3-03453 (platform-hotfix) or later, and 12.5.0-02835 (platform-hotfix) or later.

Microsoft July 2026 Patch Tuesday: Microsoft shipped fixes for a record 570 vulnerabilities (breakdown: 254 Elevation of Privilege, 145 Remote Code Execution, 102 Information Disclosure, 35 Denial of Service, 17 Security Feature Bypass, 16 Spoofing; 59 rated Critical, 48 of those RCE). Microsoft attributed the unprecedented volume in part to a newly deployed AI-powered vulnerability-discovery system scanning the Windows codebase proactively. Three zero-days were addressed: CVE-2026-56164, an unauthenticated elevation-of-privilege in SharePoint Server (2016, 2019, Subscription Edition) caused by a missing authentication check (CWE-306) in the User Profiles assembly that lets an unauthenticated network attacker escalate to Farm Administrator by omitting the security digest and supplying crafted routing headers — discovered by Mandiant/Google FLARE during real-world incident response and actively exploited despite a deceptively low CVSS of 5.3; CVE-2026-56155, a local elevation-of-privilege in Active Directory Federation Services (AD FS) rooted in insufficiently granular Distributed Key Management (DKM) container ACLs that lets a low-privileged authenticated local attacker reach administrator level and potentially expose the private keys backing an organization's federation tokens, with functional exploit code observed in the wild (CVSS 7.8); and CVE-2026-50661, a publicly disclosed (not yet observed exploited) BitLocker security-feature-bypass. Both CVE-2026-56164 and CVE-2026-56155 were added to CISA KEV. Interim mitigation for the SharePoint flaw includes enabling AMSI integration with Full Request Body Scan mode pending patch deployment on internet-facing farms.

Together, these events represent a coordinated pressure point on perimeter VPN/SSL-VPN appliances and core identity infrastructure (AD FS, SharePoint) in the same week, raising the likelihood of opportunistic and targeted follow-on exploitation by multiple threat clusters before organizations complete patching.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1059.004 Unix Shell
- T1078 Valid Accounts
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1211 Exploitation for Stealth
- T1083 File and Directory Discovery
- T1555 Credentials from Password Stores
- T1111 Multi-Factor Authentication Interception
- T1539 Steal Web Session Cookie
- T1558 Steal or Forge Kerberos Tickets
- T1087.002 Domain Account
- T1046 Network Service Discovery
- T1021 Remote Services
- T1021.004 SSH
- T1550 Use Alternate Authentication Material
- T1005 Data from Local System
- T1090 Proxy
- T1090.001 Internal Proxy
- T1531 Account Access Removal
- T1595.002 Vulnerability Scanning

## Sources

- [Critical vulnerabilities drive urgent patching across SonicWall and Microsoft products](https://www.s-rminform.com/cyber-intelligence-briefing/critical-vulnerabilities-drive-urgent-patching-across-sonicwall-and-microsoft-products)
- [Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands](https://thehackernews.com/2026/07/two-sonicwall-sma-1000-zero-days.html)
- [SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now](https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-sma1000-flaws-exploited-in-zero-day-attacks-patch-now/)
- [Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days being Actively Exploited (CVE-2026-15409, CVE-2026-15410)](https://www.rapid7.com/blog/post/etr-rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410/)
- [SonicWall SMA1000 zero-days exploited in targeted attacks](https://fieldeffect.com/blog/sonicwall-sma1000-zero-days-exploited-targeted-attacks)
- [SonicWall issues urgent patches for two actively exploited zero-day vulnerabilities in SMA 1000 appliances](https://secarma.com/15-07-2026-sonicwall-sma-1000-zero-day-exploitation)
- [Hackers Exploit SonicWall SMA1000 Zero-Days to Execute Commands as Root](https://gbhackers.com/hackers-exploit-sonicwall-sma1000-zero-days/)
- [SonicWall warns of active exploitation of two SMA 1000 zero-days](https://securityaffairs.com/195364/hacking/sonicwall-warns-of-active-exploitation-of-two-sma-1000-zero-days.html)
- [SonicWall SMA1000 Zero-Days Threat Alert](https://www.ampcuscyber.com/shadowopsintel/sonicwall-smazero-days-exploited-in-tandem-for-full-appliance-takeover/)
- [SonicWall SMA 1000 Zero-Days Are Being Exploited Right Now](https://aardwolfsecurity.com/sonicwall-sma-zero-day/)
- [SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410)](https://www.helpnetsecurity.com/2026/07/14/sonicwall-sma-attacks-via-cve-2026-15409-cve-2026-15410/)
- [Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days](https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/)
- [Microsoft July Patch Tuesday Fixes Record 570 Vulnerabilities and Three Exploited Zero-Days](https://cyberpress.org/microsoft-july-patch-tuesday/)
- [Microsoft Fixes Record 570 Security Flaws in Biggest Patch Tuesday Ever](https://www.techrepublic.com/article/news-microsoft-july-2026-patch-tuesday/)
- [Microsoft July 2026 Patch Tuesday Fixes Record 570 Flaws Including Three Zero-Days](https://www.ghacks.net/2026/07/15/microsoft-july-2026-patch-tuesday-fixes-record-570-flaws-including-three-zero-days/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1451