Critical SonicWall VPN Vulnerabilities Exploited in the Wild

Key Takeaways

• Two critical zero-day vulnerabilities in SonicWall Secure Mobile Access (SMA) VPN appliances are being actively exploited in the wild.
• The vulnerabilities, CVE-2026-15409 (SSRF) and CVE-2026-15410 (command injection), allow unauthenticated attackers to gain root access and deploy custom malware.
• Affected devices include SMA 1000 series models (6210, 7210, and 8200v).
• SonicWall has released hotfixes (12.4.3-03453 and 12.5.0-02835) to address these flaws.

Active Exploitation of SonicWall Zero-Days Leads to Root Compromise

Cybersecurity researchers have uncovered active exploitation of two zero-day vulnerabilities within SonicWall Secure Mobile Access (SMA) VPN appliances. These critical flaws are being chained by attackers to achieve root access on compromised devices and deploy sophisticated custom malware.

The investigation, initiated in early July 2026 by cybersecurity firm Volexity, focused on an intrusion involving SonicWall SMA VPN hardware. The firm’s forensic analysis revealed that a threat actor, identified as UTA0533, leveraged a series of previously unknown vulnerabilities. This sophisticated attack allowed the group to compromise the appliances, install bespoke malware, intercept network traffic, and attempt to move laterally within victim networks.

SonicWall 0-day Vulnerabilities Exploited

Volexity found evidence that exploitation of these vulnerabilities began as early as June 22, 2026. SonicWall officially disclosed the issues on July 14, 2026, confirming that SMA 1000 series models, specifically 6210, 7210, and 8200v, were impacted. The vendor promptly released hotfixes 12.4.3-03453 and 12.5.0-02835 to mitigate the risks.

The attack chain involved two distinct vulnerabilities. The first, CVE-2026-15409, is a Server-Side Request Forgery (SSRF) flaw. This vulnerability enabled unauthenticated attackers to exploit the /wsproxy endpoint to establish WebSocket tunnels to internal localhost services. The second, CVE-2026-15410, is a command injection vulnerability, which attackers leveraged to achieve arbitrary code execution on the appliances.

By exploiting CVE-2026-15409, attackers gained unauthorized access to internal services, including CouchDB on port 1050 and the SMA control service on port 8188. This access was then utilized to upload files and gather crucial information necessary for invoking privileged functions.

CVE-2026-15410 facilitated a path traversal vulnerability within the execRemoveHotfix function. This allowed attackers to execute a file placed in the /tmp directory with root privileges. Indicators of this exploitation include log entries referencing “remove_hotfix” and paths such as “../../../../../tmp/1234.sh”.

Malware Deployment and Post-Compromise Activity

On at least one compromised appliance, the threat actor UTA0533 installed a setuid root execution tool named “xzfind,” internally referred to as ROOTRUN. The group also deployed a Python-based implant known as KNUCKLEBALL, saved as deploy_new.py.

This sophisticated malware injected Java payloads into a legitimate SonicWall process and established persistence by modifying a startup script. The injected payloads included Suo5, an HTTP proxy-forwarding tool, and ORANGETAIL, a custom Java webshell that bears resemblance to the Behinder malware family.

To further evade detection and maintain access, the attackers modified the NGINX Unit configuration. This alteration redirected requests from /api/login and /api/logout to their hidden implants. These backdoors were designed to activate only when an unusual and invalid browser user-agent string was presented, making them harder to discover through routine monitoring.

Volexity also documented significant post-compromise activity, including the use of tcpdump to capture unencrypted LDAP traffic. This suggests the attackers were actively attempting to harvest usernames and passwords, signaling an intent to pivot from the compromised VPN appliances into the internal network infrastructure.

What You Should Do

• Immediately apply SonicWall hotfixes 12.4.3-03453 and 12.5.0-02835 to all affected SMA 1000 series models.
• Review /var/log/aventail/ logs for any suspicious activity related to /wsproxy.
• Inspect /tmp and /var/tmp directories for any unexpected or unauthorized files.
• Check /var/lib/unit/conf.json for any unauthorized routes pointing to 127.0.0.1:8085.
• Deploy Volexity’s published YARA rules to detect ROOTRUN, KNUCKLEBALL, and associated malware payloads within your network.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.