Unknown hackers exploited two SonicWall SMA 1000 zero-days to gain root access on VPN appliances before patches became available.
Volexity published its findings after conducting an incident response investigation involving a compromised organization whose SonicWall SMA 1000 series VPN appliances were hit with zero-day exploits starting June 22, 2026. The threat actor, which Volexity tracks as UTA0533, chained two vulnerabilities, respectively tracked as CVE-2026-15409 (CVSS score of 10.0) and CVE-2026-15410 (CVSS score of 7.2) to achieve root-level access on the devices before patches existed.
SonicWall patched both vulnerabilities this week and confirmed the active exploitation of the two zero-day vulnerabilities. The vulnerabilities were internally discovered and reported by Adam Babis of the company’s PSIRT.
SonicWall investigated multiple incidents indicating these vulnerabilities are being actively exploited in the wild.
The first vulnerability, tracked as CVE-2026-15409 (CVSS score of 10.0), is a Server-side request forgery (SSRF) issue that a remote unauthenticated attacker could exploit to potentially cause the appliance to make requests to an unintended location.
“A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.” reads the advisory.
The second vulnerability, tracked as CVE-2026-15410 (CVSS score of 7.2), is a post-authentication code injection flaw in the Appliance Management Console (AMC) that a remote authenticated attacker could exploit to execute arbitrary operating system commands as administrator under certain conditions.
“Post-authentication improper control of generation of code (‘Code Injection’) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.” continues the advisory. “SonicWall PSIRT has investigated multiple cases indicating the active exploitation of the vulnerabilities described in this advisory.”
Volexity first analyzed logs and security telemetry from two compromised SonicWall appliances. After gaining administrative SSH access, the team collected RAM, selected files, and full disk images. Initial triage quickly confirmed both devices had been compromised, while memory analysis with Volexity Volcano uncovered additional evidence of the attackers’ activity.
“Volexity’s analysis of logs, disk images, and memory led to the discovery of a threat actor Volexity tracks as UTA0533. This threat actor was observed using multiple zero-day exploits, malware designed specifically for SonicWall SMA VPN appliances, as well as other attacker tradecraft.” reads the report published Volexity. “Volexity notes that June 22, 2026, was the earliest sign of compromise observed in the investigation.”
The customization of the malware for SonicWall’s specific environment, rather than repurposing generic tooling, suggest the threat actor was prepared specifically for this target before the campaign started.
CVE-2026-15409 is a pre-authentication bypass in the appliance’s /wsproxy endpoint. An attacker sends a request with a User-Agent string containing “SMA Connect Agent” and a bmID parameter starting with -3389, and the appliance opens a WebSocket tunnel to services that are normally only reachable from localhost. Nothing about that initial request requires credentials. Once the tunnel is open, the attacker can reach the internal CouchDB database that ships with the SMA appliance, reading and writing files as the CouchDB user.
The attacker then stages a file in /tmp through the CouchDB access, using it to read the product_uuid value from the hardware identifier file at /sys/class/dmi/id/product_uuid. That UUID is the basis for the Basic authentication password protecting the SMA’s internal ctrl-service. The file is world-readable, so anyone who can reach the filesystem can derive the password. CVE-2026-15410 then comes into play: a path traversal flaw in the ctrl-service’s remove_hotfix workflow allows command execution with elevated privileges. The full chain goes from unauthenticated external access to root in a series of steps that each rely on the previous one.
“UTA0533 combined multiple zero-day vulnerabilities to compromise SonicWall SMA VPN appliances and obtain root-level access.” reads the report. “With root access, the threat actor could access stored or cached credentials, capture network traffic, and potentially intercept credentials processed by the appliances.”
A VPN appliance that handles authentication for the rest of your network is a particularly high-value target for credential interception. The attacker understood that.
On the first appliance, UTA0533 wrote a setuid binary called ROOTRUN to /usr/bin/xzfind, which allows an unprivileged user to run arbitrary commands as root. A Python script named KNUCKLEBALL was written to a site-packages directory and embedded two JAR archives that were injected into a legitimate SonicWall process. One JAR is Suo5, an open-source HTTP proxy tool. The other is ORANGETAIL, a custom Java web shell modeled on the Behinder framework, reachable through the paths /workplace/error.jsp and /workplace/dialogs/errorDialog.jsp. Both the NGINX Unit configuration and the appliance startup script were modified to ensure these components survived reboots.
The second appliance had fewer artifacts because it was rebooted on July 2, which flushed memory-resident components. However, it still showed the same NGINX configuration modifications, and the /var/tmp directory contained a script called lib.sh that launched tcpdump to capture unencrypted LDAP traffic and extract credentials passing through the appliance in cleartext.
A separate authentication bypass also exists that Volexity flagged, but it wasn’t used in this specific incident. Because the ctrl-service password is derived from the hardware UUID, and because that UUID file is readable by any local user, any unprivileged process with filesystem access can compute the password independently.
“Volexity found the product_uuid file is world readable, so unprivileged users can obtain its value. On multiple appliances to which Volexity had access, the UUID was set to a common value seen across many different systems belonging to different customers. It is a default UUID that comes with various hardware providers. Volexity only observed this UUID in cases where the owner’s device was physical, meaning virtual appliances were unaffected. Using this known UUID, an attacker would likely succeed in breaching the appliances without any other exploitation.” the cybersecurity firm notes.
“It should be noted that this authentication bypass does not appear to have been used in the observed incident. Instead, the attacker abused a different vulnerability to read the product_uuid file.”
The bypass remains real and exploitable even if UTA0533 reached the same destination through a different path.
Rapid7 published a proof-of-concept that demonstrates non-root remote code execution by tunneling the Erlang protocol through the WebSocket to the service on localhost:1050, enabling file reads, file writes, and arbitrary code execution through RPC calls.
“This is the first-stage vulnerability, CVE-2026-15409, that Rapid7 MDR analysts are seeing attackers exploit in the wild.” states Rapid7. “With this capability, an attacker can reach and exploit less-hardened services running on the appliance, such as the Erlang application on localhost:1050 or the ctrl-service application on localhost:8188.”
Services running on localhost are often less hardened precisely because they’re expected to be unreachable from outside, and the /wsproxy bypass eliminates that assumption entirely.
SonicWall released patches this week. Virtual appliances aren’t affected by the hardware UUID-derived password issue because product_uuid values only exist on physical hardware, but they’re still vulnerable to the core exploitation chain involving CVE-2026-15409 and CVE-2026-15410. UTA0533 appears to have had more success on the VPN appliances themselves than in moving laterally into the broader network afterward, but credential interception through an appliance that processes every authentication session is a serious enough outcome on its own without needing to pivot further. Check both your appliances and your downstream authentication infrastructure for signs of unexpected access.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
Pierluigi Paganini
(SecurityAffairs – hacking, newsletter)
Entrar
