Critical SonicWall SMA 1000 Zero-Day Vulnerabilities - Patch and Investigate for Compromise (CVE-2026-15409 & CVE-2026-15410)

Published: Wed 22 July 2026

Prepared by: Adam Skupien, Vulnerability Security Analyst

Purpose

SonicWall has disclosed two vulnerabilities affecting SMA 1000 Series secure remote access appliances - CVE-2026-15409 (Server-Side Request Forgery, CVSSv3.1 10.0) and CVE-2026-15410 (Code Injection / path traversal, CVSSv3.1 7.2) - which can be chained by an unauthenticated remote attacker to achieve root-level remote code execution.

SonicWall has confirmed both vulnerabilities were actively exploited in the wild as zero-days before a patch existed, and independent research from Volexity has since shown targeted exploitation dating back to at least 22 June 2026 - around three weeks before public disclosure on 14 July 2026. Attackers used the flaws to deploy custom malware, harvest credentials and session/TOTP data, capture internal network traffic, and attempt to pivot into internal networks from the compromised appliance.

Patches have been available since 14 July 2026. Patching alone is also not sufficient - because this was exploited as a confirmed zero-day, any organisation running an internet-facing SMA 1000 appliance on an affected firmware version at any point since at least 22 June 2026 must also carry out the compromise investigation steps below, whether or not the appliance has already been patched.

Vulnerability details

CVE-2026-15409 — Server-Side Request Forgery (SSRF)

• Severity: Critical (CVSSv3.1 10.0).
• Exploit status: Exploited in the wild as a zero-day (vendor-confirmed); independently confirmed by Volexity and Rapid7.
• Vulnerability type: Pre-authentication SSRF in the SMA1000 "Work Place" web interface, via the /wsproxy websocket-proxy endpoint.
• Exploitation requirements: No authentication or user interaction required. A crafted GET /wsproxy request (using the User-Agent: SMA Connect Agent header and a bmID parameter beginning with -3389) opens a websocket tunnel from the internet directly to services that are normally localhost-only.
• Impact of this stage alone: Attacker gains a network path into internal-only appliance services, including CouchDB (port 1050), the Erlang Port Mapper Daemon (port 1051), and the appliance's internal control service (port 8188).

CVE-2026-15410 — Code Injection / Path Traversal

• Severity: High (CVSSv3.1 7.2).
• Vulnerability type: Path traversal in the remove_hotfix helper invoked by the appliance's control-service sysCtrl.execRemoveHotfix function, which normally requires administrator access to the Appliance Management Console (AMC).
• Chained impact: In the exploitation observed by Volexity and Rapid7, attackers used the SSRF tunnel from CVE-2026-15409 to reach the control service directly (bypassing the network segmentation that would normally restrict it to localhost), then used the appliance's embedded CouchDB service — which ships with hard-coded default credentials — to stage a script and trigger the path-traversal flaw. This allowed root command execution without any valid SMA administrator credentials.
• Note for physical appliance owners: Volexity also identified that the control service's Basic Auth password is derived from the device's hardware UUID (/sys/class/dmi/id/product_uuid), which is world-readable and, on many physical units, set to a common default value shared across customers. An attacker who already knows this common default value could compute the password and reach the control service directly, without needing the CouchDB step described above. Volexity was explicit that this shortcut does not appear to be what UTA0533 actually used in the incidents it investigated - the attacker instead went via CouchDB to read the device's genuine UUID. This finding does not affect virtual appliances (no product_uuid exists), which remain fully exposed to the core SSRF + path-traversal chain regardless. This is a distinct issue from the two patched CVEs, and public reporting does not confirm whether the hotfix changes it. Because it's a weak local-authentication design flaw rather than part of the SSRF/path-traversal chain being fixed, a physical appliance with the common default UUID could remain exposed to instant control-service access via any future means of reaching 127.0.0.1:8188 - not just the vector patched here. Physical appliance owners should ask SonicWall Support to confirm whether their device's UUID matches the widely shared default value, and whether the hotfix or a configuration change addresses this exposure. 

Exposure condition: Applies to internet-facing SMA1000 Work Place interfaces — which is the standard, intended deployment model for these devices.

Affected systems

Not impacted: SSL VPN functionality on SonicWall firewalls; the SMA 100 Series product line.

Impact

Successful exploitation gives an unauthenticated attacker root-level control of an internet-facing remote access gateway. Because SMA1000 appliances sit at the network edge and broker credentials, sessions, and MFA data for every remote user, a compromised appliance can be used to:

• Harvest cached credentials, active session tokens, and TOTP/MFA seed data.
• Capture unencrypted internal traffic (e.g. LDAP) transiting or reachable from the appliance.
• Authenticate directly against internal systems (e.g. Active Directory) as an unmonitored, VPN-less foothold.
• Host a persistent, appliance-specific webshell that survives casual inspection.

Volexity's investigation found the observed threat actor (tracked as UTA0533, previously undocumented) achieved all of the above on compromised appliances, though it assessed the actor was less successful pivoting further into victim networks.

Mitigation actions

Patch immediately — there is no workaround. SonicWall's advisory (SNWLID-2026-0008) lists no mitigating configuration or workaround; the hotfix upgrade is the only remediation offered. This is corroborated by independent researchers (Rapid7, Tenable).

• Upgrade all SMA1000 appliances (hardware and virtual) to 12.4.3-03453 or 12.5.0-02835 (or later), available via MySonicWall.
• Do not treat patching as closing the incident — proceed to the investigation steps below for every affected appliance, regardless of whether it has already been patched.

Has your organisation already been compromised? Investigation guidance

Given confirmed zero-day exploitation from at least 22 June 2026, treat every internet-facing SMA1000 appliance that was running an affected firmware version at any point since that date as a potential compromise, not just a vulnerable asset.

1. Review appliance logs for these indicators:

2. Check the filesystem and running processes:

• Unexpected files in /tmp and /var/tmp (observed artefact names include 1234.sh, hypdate.b64, and lib.sh, plus tcpdump capture files).
• Unexpected setuid binaries: run find / -perm -4000 and review anything beyond the standard baseline (mysql auth_pam_tool, ssh-keysign, umount, su, mount, newgrp, at, ping/ping6, sudo, /usr/local/workplace/conf).
• The workplace.startup.CommandStartup Java process for injected in-memory agents (a reboot can clear this from memory but does not remove other footholds).
• /etc/init.d/workplace for an added line invoking python3 against an unexpected script.

3. Match against known malware from this campaign (attributed by Volexity to a threat actor it tracks as UTA0533):

Full SHA1/SHA256 hashes and YARA rules are published in Volexity's blog (linked below).

4. Check for lateral movement into your directory environment:

• Review Active Directory / domain controller logs for Windows Event ID 4624, logon type 3, originating from the SMA appliance's internal IP address - particularly where the client workstation name is non-standard (e.g. kali, DESKTOP-*) and there is no corresponding active VPN session. This pattern indicates the appliance itself authenticating directly against internal systems, not a legitimate remote user.
• Treat directory-service credentials that may have transited the appliance as potentially exposed - Volexity observed attackers using tcpdump on a compromised appliance to capture unencrypted LDAP authentication traffic.

5. Supplementary network indicators (use with caution):

Rapid7 observed exploitation traffic from ASN 206092 (F.N.S Holdings Limited) and the ranges 45.131.194.0/24, 45.146.54.0/24, 63.135.161.0/24, and 173.239.211.0/24. However, Volexity recorded activity from over 200 different source IPs across the campaign, many via commercial VPN services (ExpressVPN, Mullvad). IP-based indicators should be treated as supplementary only - the log, filesystem, and hash-based indicators above are far more reliable.

If any of the above indicators are present, do not simply patch and move on. Per SonicWall's guidance:

• Treat the appliance as compromised.
• Re-image physical appliances or redeploy virtual appliances from a known-clean source - do not remediate in place.
• Change all user and administrator passwords associated with the appliance.
• Reset TOTP/MFA seed data for all users.
• Do not restore from a configuration backup unless it pre-dates the December hotfix versions (12.4.3-03245 / 12.5.0-02283). If no earlier clean backup exists, thoroughly audit the current configuration for tampering before trusting it.
• Rotate credentials for any directory service accounts that may have authenticated through the appliance, and review your AD environment for signs of it being used as an internal foothold.
• Engage incident response support to scope potential lateral movement before considering an incident contained - this is not a "patch and verify" scenario.

Detection capabilities

MDR customers: Triskele Labs will continue tuning detections for behaviours consistent with the exploitation of CVE-2026-15409 and CVE-2026-15410 across supported log sources.

Vulnerability Management customers: Environments will be assessed for exposed and vulnerable SMA1000 appliance versions; any findings will be communicated through priority channels.

References

• SonicWall Product Notice: SMA 1000 Series affected by Multiple Vulnerabilities
• SonicWall PSIRT Advisory SNWLID-2026-0008
• Volexity — Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation
• Rapid7 — Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days being Actively Exploited