# SonicWall SMA1000 Zero-Days (CVE-2026-15409, CVE-2026-15410) Chained in Active Attacks, Assessed Ransomware Precursor

> Rapid7's MDR team discovered attackers chaining an unauthenticated CVSS 10.0 SSRF (CVE-2026-15409) with a post-authentication code injection flaw (CVE-2026-15410) in SonicWall SMA1000 secure remote access appliances (SMA6210, SMA7210, SMA8200v), achieving full unauthenticated root compromise. Exploitation began by June 22, 2026, involved credential/TOTP-seed theft and lateral movement to domain controllers, and was assessed as ransomware-precursor activity though exfiltration and encryption were prevented in observed cases. Both CVEs were added to CISA KEV with a July 17, 2026 federal remediation deadline.

- **Published:** 2026-07-17T00:00:00Z
- **Last reviewed:** 2026-08-12T06:19:35.654Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1462
- **ID:** TL-2026-1462
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** INC Ransomware
- **Detections:** 9 · **IOCs:** 72 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-15409, CVE-2026-15410

## Description

SonicWall SMA1000-series secure mobile access appliances (models SMA6210, SMA7210, SMA8200v) were found to contain two chainable zero-day vulnerabilities that together provide a fully remote, unauthenticated path to root-level operating system command execution. CVE-2026-15409 is a CWE-918 server-side request forgery (SSRF) in the SMA1000 WorkPlace web interface (port 443): an unauthenticated remote attacker can abuse the /wsproxy endpoint, which builds websocket-based TCP tunnels from attacker-supplied host/port parameters, to reach localhost-only internal services that are otherwise unreachable from the network. Rapid7 observed attackers using this SSRF to pivot to the ctrl-service application listening on localhost:8188, and to a hardcoded-cookie-authenticated Erlang process on localhost:1050 that provided initial code execution as the low-privileged couchdb user (UID 1010).

CVE-2026-15410 is a CWE-94 code injection vulnerability in the Appliance Management Console (AMC) / ctrl-service's remove_hotfix workflow. The workflow fails to validate hotfix filenames supplied to it, allowing path traversal sequences (e.g. "../../../../../../tmp/") to be smuggled through and executed as arbitrary OS commands running as root. SonicWall's own advisory (SNWLID-2026-0008) scopes CVE-2026-15410 as requiring high privileges (a remote authenticated administrator), giving it a standalone CVSS v3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H); however, because CVE-2026-15409's SSRF grants an unauthenticated actor a network path directly to the same internal ctrl-service listener that CVE-2026-15410 targets, security researchers (Tenable, Rapid7) assess the pair combine into a single unauthenticated, fully remote root-RCE chain — consistent with the CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) rating assigned to CVE-2026-15409 itself.

Rapid7's MDR team first observed exploitation in the wild on June 22, 2026 (per reporting to CyberScoop), with a wider wave of targeted, internet-facing exploitation flagged around July 9, 2026. Post-compromise activity observed by Rapid7 included reconnaissance of the exposed appliance, harvesting of stored credentials, session databases, and TOTP MFA seed configuration from the appliance, and subsequent lateral movement — attackers authenticated directly to Active Directory domain controllers from the compromised appliance's IP address without ever establishing a legitimate VPN session, effectively using the SMA1000 as an unmonitored backdoor into the internal network. Overlapping TTPs across observed intrusions point to a single threat actor or a small cluster of closely coordinated actors, though SonicWall and Rapid7 have not published a named-group attribution. Rapid7 assessed the intrusions as ransomware-motivated based on post-exploitation behavior, but reported that in the cases it observed, MDR response actions prevented the actors from completing data exfiltration or deploying ransomware/encryption. A prior source URL referencing an "INC ransomware" attribution for this campaign (darkreading.com) returned HTTP 403 and could not be corroborated via search; no ransomware group name is asserted in this record.

SonicWall published advisory SNWLID-2026-0008 on July 14, 2026, confirming multiple customer incidents of active exploitation and releasing hotfixed firmware (12.4.3-03453 and 12.5.0-02835) with no interim workaround available. CISA added both CVEs to the Known Exploited Vulnerabilities (KEV) catalog on July 15, 2026, with a Federal Civilian Executive Branch remediation deadline of July 17, 2026 under Binding Operational Directive 22-01. Given the confirmed compromise activity, SonicWall's guidance for affected organizations goes beyond patching: full forensic log review, re-imaging or redeployment of appliances where compromise indicators are found, rotation of all user and administrator credentials, and regeneration of TOTP MFA seeds are all recommended, since simply patching a compromised appliance would not remove an attacker's persistence or stolen credentials.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1556 Modify Authentication Process
- T1070 Indicator Removal
- T1552 Unsecured Credentials
- T1111 Multi-Factor Authentication Interception
- T1528 Steal Application Access Token
- T1046 Network Service Discovery
- T1016 System Network Configuration Discovery
- T1087 Account Discovery
- T1021 Remote Services
- T1210 Exploitation of Remote Services
- T1078 Valid Accounts
- T1005 Data from Local System
- T1090 Proxy
- T1572 Protocol Tunneling
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact
- T1595 Active Scanning
- T1037 Boot or Logon Initialization Scripts
- T1548 Abuse Elevation Control Mechanism
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1040 Network Sniffing
- T1550 Use Alternate Authentication Material
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1059.006 Command and Scripting Interpreter: Python
- T1505.003 Server Software Component: Web Shell
- T1543 Create or Modify System Process
- T1110 Brute Force
- T1557.003 DHCP Spoofing
- T1095 Non-Application Layer Protocol

## Sources

- [Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days being Actively Exploited (CVE-2026-15409, CVE-2026-15410)](https://www.rapid7.com/blog/post/etr-rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410/)
- [SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now](https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-sma1000-flaws-exploited-in-zero-day-attacks-patch-now/)
- [SonicWall CVE-2026-15409 and CVE-2026-15410 zero-day exploited](https://www.tenable.com/blog/cve-2026-15409-cve-2026-15410-sonicwall-sma-1000-zero-day-vulnerabilities-exploited-in-the)
- [Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands](https://thehackernews.com/2026/07/two-sonicwall-sma-1000-zero-days.html)
- [SonicWall Security Advisory SNWLID-2026-0008](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008)
- [NVD - CVE-2026-15409 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-15409)
- [NVD - CVE-2026-15410 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-15410)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2026-15409](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2026-15410](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15410)
- [SonicWall customers under threat as attackers exploit 2 zero-days - CyberScoop](https://cyberscoop.com/sonicwall-zero-day-vulnerabilities-exploited/)
- [SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410) - Help Net Security](https://www.helpnetsecurity.com/2026/07/14/sonicwall-sma-attacks-via-cve-2026-15409-cve-2026-15410/)
- [SonicWall SMA1000 vulnerabilities in active exploitation - Sophos](https://www.sophos.com/en-us/blog/sonicwall-sma1000-vulnerabilities-in-active-exploitation)
- [SonicWall Issues Urgent SMA Patch Warning for Two Zero-Day Exploits - SecurityWeek](https://www.securityweek.com/sonicwall-issues-urgent-sma-patch-warning-for-two-zero-day-exploits/)
- [Product Notice: SMA 1000 Series affected by Multiple Vulnerabilities](https://www.sonicwall.com/support/notices/product-notice-sma-1000-series-affected-by-multiple-vulnerabilities/kA1VN000001nv6D0AQ)
- [SonicWall SMA1000: Attacks on partly critical zero-day vulnerabilities - Heise](https://www.heise.de/en/news/SonicWall-SMA1000-Attacks-on-partly-critical-zero-day-vulnerabilities-11365673.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1462