FlagThis

← Back to Daily Briefing

Critical Zero-Day Exploitation of SonicWall SMA1000 Series Appliances

Published July 19, 2026
Vulnerability Analysis🏢 SonicWall#SonicWall#UTA0533#ZeroDay#RCE#VulnerabilityAnalysis

Threat actor UTA0533 is actively exploiting a dual-vulnerability chain targeting SonicWall SMA1000 Series appliances to achieve full perimeter compromise. The attack initiates with CVE-2026-15409, an unauthenticated SSRF in the /wsproxy websocket proxy, allowing attackers to establish TCP tunnels to internal services. This enables the exploitation of CVE-2026-15410, a path traversal vulnerability within the ctrl-service remove_hotfix workflow, resulting in root-level RCE. Post-exploitation activities include the theft of TOTP MFA seeds, session databases, and LDAP credentials, facilitating "VPN-less" lateral movement to internal Domain Controllers. CISA has mandated remediation before the July 17, 2026 deadline.

  • Vulnerability Mechanics & Attack Chain

    • CVE-2026-15409 (SSRF): An unauthenticated Server-Side Request Forgery in the /wsproxy component enables attackers to tunnel TCP traffic to arbitrary internal localhost ports.
    • CVE-2026-15410 (RCE): A path traversal vulnerability in the ctrl-service remove_hotfix workflow allows for the execution of arbitrary scripts with root privileges.
    • Chained Execution: The SSRF acts as a pivot to reach the restricted ctrl-service (port 8188), which is then abused to achieve remote code execution.

  • Threat Actor Profile & Impact

    • Actor Attribution: Operations have been attributed to UTA0533, a highly sophisticated group observed exploiting these assets since June 22, 2026.
    • Credential Harvesting: Actors prioritize the extraction of TOTP MFA seeds, session databases, and LDAP credentials to bypass secondary authentication.
    • Lateral Movement: Compromised appliances are used to perform "VPN-less" lateral movement, authenticating directly to Domain Controllers to mask malicious traffic as legitimate service activity.

  • Affected Hardware & Criticality

    • Hardware Scope: Primarily affects SonicWall SMA1000 Series 6210, 7210, and 8200v appliances.
    • Severity Level: Critical CVSS 10.0 rating due to unauthenticated perimeter access and full system control.
    • Remediation Timeline: CISA KEV mandate requires immediate patching/mitigation before July 17, 2026.

  • Detection & Indicators of Compromise (IoCs)

    • Log Analysis:
      • extraweb_access.log: Search for GET requests to /wsproxy with 101 status codes and 0.0.0.0 or localhost in host parameters.
      • ctrl-service.log: Monitor for /usr/local/bin/remove_hotfix invocations containing traversal sequences (e.g., ../).
    • Network & Host Behavior:
      • Windows Event ID 4624 (Logon Type 3) originating from SMA internal IPs using anomalous hostnames like "kali."
      • Known C2 IP ranges associated with F.N.S Holdings Limited: 45.131.194.0/24, 45.146.54.0/24, 63.135.161.0/24, and 173.239.211.0/24.
    • Filesystem Artifacts: Presence of unauthorized routes in /var/lib/unit/conf.json or unexpected files in /tmp/temp.db*.

Related posts

  1. falconinternet.net — SonicWall SMA1000 Zero-Days: CVSS 10.0 + RCE in Active Exploitation — Patch Before July 17
  2. Security Affairs — Volexity Uncovers Zero-Day Campaign Targeting SonicWall VPN Appliances
  3. socprime.com — CVE-2026-15410 and CVE-2026-15409: SonicWall SMA 1000 Zero-Days Exploited in the Wild
  4. fieldeffect.com — SonicWall SMA1000 zero-days exploited in targeted attacks
  5. thecyberexpress.com — CISA Adds SonicWall SMA1000 Vulnerabilities to KEV Catalog Following Active Exploitation
  6. helpnetsecurity.com — SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410)
  7. Rapid7 Blog — Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days being Actively Exploited (CVE-2026-15409, CVE-2026-15410)
  8. Tenable Blog — CVE-2026-15409, CVE-2026-15410: SonicWall SMA 1000 zero-day vulnerabilities exploited in the wild
  9. feeds.feedburner.com — SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access
  10. Esentire
  11. Youtube
  12. Sonicwall
  13. Psirt
  14. Dark Reading — Inc Ransomware Exploits SonicWall SMA Zero-Days
LINK COPIED TO CLIPBOARD