SonicWall SMA 1000 Series Mass Exploitation and UK Public Sector Breach
This campaign involves the mass exploitation of a critical vulnerability in SonicWall SMA 1000 series devices to gain initial perimeter access. Attackers utilize weaponized payloads to compromise the VPN gateway, subsequently pivoting to internal Active Directory (AD) environments for credential harvesting and NTDS.dit theft. This lifecycle resulted in the operational disruption of the Borough Council of King's Lynn and West Norfolk and indicates a systemic risk to UK public sector infrastructure. The attack progression focuses on achieving total domain dominance to facilitate large-scale data exfiltration or ransomware deployment, mirroring patterns seen in recent critical infrastructure hits including the NHS Synnovis incident.
Critical Zero-Day Exploitation of SonicWall SMA1000 Series Appliances
Threat actor UTA0533 is actively exploiting a dual-vulnerability chain targeting SonicWall SMA1000 Series appliances to achieve full perimeter compromise. The attack initiates with CVE-2026-15409, an unauthenticated SSRF in the /wsproxy websocket proxy, allowing attackers to establish TCP tunnels to internal services. This enables the exploitation of CVE-2026-15410, a path traversal vulnerability within the ctrl-service remove_hotfix workflow, resulting in root-level RCE. Post-exploitation activities include the theft of TOTP MFA seeds, session databases, and LDAP credentials, facilitating "VPN-less" lateral movement to internal Domain Controllers. CISA has mandated remediation before the July 17, 2026 deadline.