SonicWall SMA1000 Zero-Days (CVE-2026-15409, CVE-2026-15410) Chained in Active Attacks, Assessed Ransomware Precursor

SonicWall SMA1000 Zero-Days (CVE-2026-15409, CVE-2026-15410) (TL-2026-1462) is a critical-severity software vulnerability scored CVSS 10, first published 2026-07-17 and last reviewed 2026-08-12. It is attributed to INC Ransomware with high confidence, affects SonicWall SMA6210, references 2 CVEs (CVE-2026-15409, CVE-2026-15410), maps to 66 MITRE ATT&CK techniques (T1003, T1005, T1016), and is covered by 9 detection rules and 72 indicators of compromise.

Key facts for TL-2026-1462

Threat ID
TL-2026-1462
Severity
CRITICAL
CVSS
10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-17
Last reviewed
2026-08-12
Attribution
INC Ransomware
Attribution confidence
HIGH
Motivation
FINANCIAL
Target sectors
government administration, finance, health, technology, critical-infrastructure, professional-services
Target regions
North America, Europe, Global
Detection rules
9
Indicators of compromise
72
Updates
2026-08-12 · 8 updates · revalidated 7× · latest source

Malware and tooling in SonicWall SMA1000 Zero-Days (CVE-2026-15409, CVE-2026-15410)

Malware and tooling: localhost:1050 Erlang process hardcoded-cookie authentication

Rapid7's MDR team discovered attackers chaining an unauthenticated CVSS 10.0 SSRF (CVE-2026-15409) with a post-authentication code injection flaw (CVE-2026-15410) in SonicWall SMA1000 secure remote access appliances (SMA6210, SMA7210, SMA8200v), achieving full unauthenticated root compromise. Exploitation began by June 22, 2026, involved credential/TOTP-seed theft and lateral movement to domain controllers, and was assessed as ransomware-precursor activity though exfiltration and encryption were prevented in observed cases. Both CVEs were added to CISA KEV with a July 17, 2026 federal remediation deadline.

How SonicWall SMA1000 Zero-Days (CVE-2026-15409, CVE-2026-15410) works

SonicWall SMA1000-series secure mobile access appliances (models SMA6210, SMA7210, SMA8200v) were found to contain two chainable zero-day vulnerabilities that together provide a fully remote, unauthenticated path to root-level operating system command execution. CVE-2026-15409 is a CWE-918 server-side request forgery (SSRF) in the SMA1000 WorkPlace web interface (port 443): an unauthenticated remote attacker can abuse the /wsproxy endpoint, which builds websocket-based TCP tunnels from attacker-supplied host/port parameters, to reach localhost-only internal services that are otherwise unreachable from the network. Rapid7 observed attackers using this SSRF to pivot to the ctrl-service application listening on localhost:8188, and to a hardcoded-cookie-authenticated Erlang process on localhost:1050 that provided initial code execution as the low-privileged couchdb user (UID 1010).

CVE-2026-15410 is a CWE-94 code injection vulnerability in the Appliance Management Console (AMC) / ctrl-service's remove_hotfix workflow. The workflow fails to validate hotfix filenames supplied to it, allowing path traversal sequences (e.g. "../../../../../../tmp/") to be smuggled through and executed as arbitrary OS commands running as root. SonicWall's own advisory (SNWLID-2026-0008) scopes CVE-2026-15410 as requiring high privileges (a remote authenticated administrator), giving it a standalone CVSS v3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H); however, because CVE-2026-15409's SSRF grants an unauthenticated actor a network path directly to the same internal ctrl-service listener that CVE-2026-15410 targets, security researchers (Tenable, Rapid7) assess the pair combine into a single unauthenticated, fully remote root-RCE chain — consistent with the CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) rating assigned to CVE-2026-15409 itself.

Rapid7's MDR team first observed exploitation in the wild on June 22, 2026 (per reporting to CyberScoop), with a wider wave of targeted, internet-facing exploitation flagged around July 9, 2026. Post-compromise activity observed by Rapid7 included reconnaissance of the exposed appliance, harvesting of stored credentials, session databases, and TOTP MFA seed configuration from the appliance, and subsequent lateral movement — attackers authenticated directly to Active Directory domain controllers from the compromised appliance's IP address without ever establishing a legitimate VPN session, effectively using the SMA1000 as an unmonitored backdoor into the internal network. Overlapping TTPs across observed intrusions point to a single threat actor or a small cluster of closely coordinated actors, though SonicWall and Rapid7 have not published a named-group attribution. Rapid7 assessed the intrusions as ransomware-motivated based on post-exploitation behavior, but reported that in the cases it observed, MDR response actions prevented the actors from completing data exfiltration or deploying ransomware/encryption. A prior source URL referencing an "INC ransomware" attribution for this campaign (darkreading.com) returned HTTP 403 and could not be corroborated via search; no ransomware group name is asserted in this record.

SonicWall published advisory SNWLID-2026-0008 on July 14, 2026, confirming multiple customer incidents of active exploitation and releasing hotfixed firmware (12.4.3-03453 and 12.5.0-02835) with no interim workaround available. CISA added both CVEs to the Known Exploited Vulnerabilities (KEV) catalog on July 15, 2026, with a Federal Civilian Executive Branch remediation deadline of July 17, 2026 under Binding Operational Directive 22-01. Given the confirmed compromise activity, SonicWall's guidance for affected organizations goes beyond patching: full forensic log review, re-imaging or redeployment of appliances where compromise indicators are found, rotation of all user and administrator credentials, and regeneration of TOTP MFA seeds are all recommended, since simply patching a compromised appliance would not remove an attacker's persistence or stolen credentials.

MITRE ATT&CK techniques used in TL-2026-1462

Credential Access

T1003 OS Credential Dumping; T1040 Network Sniffing; T1110 Brute Force; T1111 Multi-Factor Authentication Interception; T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1552.001 Unsecured Credentials: Credentials In Files

Collection

T1005 Data from Local System; T1557.003 DHCP Spoofing

Discovery

T1016 System Network Configuration Discovery; T1046 Network Service Discovery; T1057 Process Discovery; T1083 File and Directory Discovery; T1087 Account Discovery

Lateral Movement

T1021 Remote Services; T1021.002 SMB/Windows Admin Shares; T1210 Exploitation of Remote Services; T1550 Use Alternate Authentication Material; T1570 Lateral Tool Transfer

Defense Evasion

T1027 Obfuscated Files or Information; T1027.013 Obfuscated Files or Information: Encrypted/Encoded File; T1036 Masquerading; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1205.001 Port Knocking; T1211 Exploitation for Stealth; T1562.006 Impair Defenses: Indicator Blocking; T1622 Debugger Evasion

Persistence

T1037 Boot or Logon Initialization Scripts; T1037.004 Boot or Logon Initialization Scripts: RC Scripts; T1505 Server Software Component; T1505.003 Server Software Component: Web Shell; T1543.002 Create or Modify System Process: Systemd Service

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Execution

T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.006 Command and Scripting Interpreter: Python; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism; T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid

Command and Control

T1071 Application Layer Protocol; T1090 Proxy; T1095 Non-Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1572 Protocol Tunneling; T1573 Encrypted Channel

stealth

T1078 Valid Accounts; T1078.002 Domain Accounts

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery; T1657 Financial Theft

persistence

T1543 Create or Modify System Process

defense-impairment

T1556 Modify Authentication Process; T1601.001 Patch System Image

Resource Development

T1583 Acquire Infrastructure; T1583.001 Domains; T1587 Develop Capabilities

Reconnaissance

T1592 Gather Victim Host Information; T1595 Active Scanning

Affected products and versions in SonicWall SMA1000 Zero-Days (CVE-2026-15409, CVE-2026-15410)

  • SonicWall — SMA6210
    Vulnerable versions: 12.4.3-03245; 12.4.3-03387; 12.4.3-03434; 12.5.0-02283; 12.5.0-02624; 12.5.0-02800
    Fixed in: 12.4.3-03453; 12.5.0-02835
  • SonicWall — SMA7210
    Vulnerable versions: 12.4.3-03245; 12.4.3-03387; 12.4.3-03434; 12.5.0-02283; 12.5.0-02624; 12.5.0-02800
    Fixed in: 12.4.3-03453; 12.5.0-02835
  • SonicWall — SMA8200v
    Vulnerable versions: 12.4.3-03245; 12.4.3-03387; 12.4.3-03434; 12.5.0-02283; 12.5.0-02624; 12.5.0-02800
    Fixed in: 12.4.3-03453; 12.5.0-02835

Remediation for SonicWall SMA1000 Zero-Days (CVE-2026-15409, CVE-2026-15410)

Patches

  • SonicWall platform-hotfix 12.4.3-03453 or later
  • SonicWall platform-hotfix 12.5.0-02835 or later

Immediate actions

  • Upgrade SMA1000 appliances to platform-hotfix 12.4.3-03453 or later (12.4.3 branch) or 12.5.0-02835 or later (12.5.0 branch) via mysonicwall.com
  • Take internet-facing SMA1000 WorkPlace and AMC interfaces offline or restrict access via ACL/firewall until patched
  • Review extraweb_access.log for /wsproxy requests with anomalous host/port parameters and HTTP 101 status codes
  • Review ctrl-service.log for remove_hotfix invocations containing path traversal sequences (e.g. "../../../../../../tmp/")
  • Check for unexpected files under /tmp/temp.db* and unauthorized routes in /var/lib/unit/conf.json

Workarounds

  • No official workaround is available; SonicWall states patching is the only remediation

Longer-term hardening

  • Deploy network-level monitoring for anomalous direct-to-domain-controller authentication originating from SMA/VPN appliance IP addresses without a corresponding active VPN session
  • Implement egress/lateral-movement segmentation between remote-access appliances and internal Active Directory infrastructure
  • Adopt centralized, off-appliance log forwarding for SMA1000 appliances so logs survive a compromise/re-image
  • Establish a recurring firmware patch cadence for perimeter remote-access appliances given repeated SMA/SSL-VPN zero-day exploitation history

CVEs associated with SonicWall SMA1000 Zero-Days (CVE-2026-15409, CVE-2026-15410)

CVE-2026-15409, CVE-2026-15410

Weaknesses (CWE) in SonicWall SMA1000 Zero-Days (CVE-2026-15409, CVE-2026-15410)

CWE-918, CWE-94, CWE-22, CWE-78

Timeline of SonicWall SMA1000 Zero-Days (CVE-2026-15409, CVE-2026-15410)

Showing the 20 most recent tracked events.

  • Rapid7's MDR team observed a wave of targeted exploitation against internet-facing SonicWall SMA1000 appliances and began investigating the zero-day chain.
  • CVE-2026-15409 and CVE-2026-15410 published to NVD with full CVSS v3.1 vectors and CWE classifications.
  • SonicWall published security advisory SNWLID-2026-0008 disclosing CVE-2026-15409 (CVSS 10.0 SSRF) and CVE-2026-15410 (CVSS 7.2 code injection) and releasing hotfixed firmware.
  • Rapid7 publishes a public proof-of-concept for CVE-2026-15409 to GitHub (remmons-r7/rapid7-CVE-2026-15409), increasing the risk of opportunistic reuse by other actors.
  • CISA added CVE-2026-15409 and CVE-2026-15410 to the Known Exploited Vulnerabilities (KEV) catalog.
  • Rapid7 published its ETR blog detailing the exploit chain, post-exploitation TTPs, and indicators of compromise; Tenable published independent technical analysis of the chained SSRF-to-RCE path.
  • Rapid7 and downstream researchers published additional indicators of compromise, including VPN-provider ASN infrastructure and attacker-associated hostnames.
  • INC Ransomware, showing significant TTP overlap with the earlier UTA0533 activity, accelerates exploitation of unpatched appliances and begins publishing new victims to its data-leak site.
  • Volexity publishes 'Proxying to Compromise', full technical analysis attributing the intrusion to UTA0533 and detailing KNUCKLEBALL, ORANGETAIL, and Suo5 tooling with IOCs.
  • CISA Binding Operational Directive 22-01 federal remediation deadline for CVE-2026-15409 and CVE-2026-15410 for Federal Civilian Executive Branch agencies.
  • SecurityWeek and other outlets report on the UTA0533 campaign and Volexity's state-sponsored APT assessment.
  • ProjectDiscovery merges a Nuclei detection template (CVE-2026-15409.yaml) for identifying the unauthenticated SSRF via WebSocket proxy on SMA1000 appliances.
  • Security press (CSOOnline, DarkReading) reports INC Ransomware deploying the ROOTRUN/KNUCKLEBALL/Suo5/ORANGETAIL implant toolkit against already-patched-but-previously-compromised SMA devices.
  • Ongoing security media coverage (GBHackers and others) continues to warn organizations of active exploitation and the need for compromise assessment beyond patching.
  • The Raven File publishes a threat-intelligence report documenting 108 INC Ransomware malware samples, 170+ infrastructure IPs, 9 clearnet domains, and 5 Tor onion services, and de-anonymizes the negotiation panel at 178.20.41.208:1002.
  • Suriq publishes independent analysis corroborating that INC Ransomware used the SonicWall SMA zero-day chain to steal TOTP MFA seed configurations and active session databases.
  • INC Ransomware's data-leak site places its cumulative victim count at 885 since 2023, with the July 17-August 1 wave the fastest-growing period in the campaign.
  • Resecurity publishes a deep-dive attributing the full exploit chain and toolkit to INC Ransomware, confirming new victims across Australia, the United States, UAE, Colombia, and Switzerland between July 17 and August 1, and noting many devices remain unpatched.
  • Cyber Security News publishes a summary article on the SonicWall SMA zero-click chain, the triggering source for this revalidation.
  • Bitdefender's August 2026 Threat Debrief formally attributes the June 2026-onward SMA1000 exploitation chain, including KNUCKLEBALL/ORANGETAIL tooling, to INC Ransom, corroborating the earlier Volexity/Rapid7/Resecurity attribution.

Update history for TL-2026-1462

Sources cited for SonicWall SMA1000 Zero-Days (CVE-2026-15409, CVE-2026-15410)

Threats related to SonicWall SMA1000 Zero-Days (CVE-2026-15409, CVE-2026-15410)

Detection coverage for TL-2026-1462

As of 2026-08-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1462 across Splunk SPL, Microsoft KQL and Sigma, covering 72 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats