SonicWall VPN Zero-Days Rooted Appliances for Weeks

Two SonicWall Secure Mobile Access 1000 vulnerabilities were exploited as zero-days for roughly three weeks before anyone outside the attacker knew they existed. Volexity attributes the campaign to a previously undocumented actor it tracks as UTA0533, which chained CVE-2026-15409 and CVE-2026-15410 to take root on internet-facing appliances, install custom malware, and harvest plaintext LDAP credentials on their way into customer networks. If you run an SMA 1000, patching is necessary and is not sufficient: an actor who had root and your directory passwords does not lose access because you applied an update.

• The chain is pre-authentication and ends in root: an SSRF through /wsproxy, then a path traversal in the hotfix-removal function that executes a staged payload.
• The middle link is not a CVE at all. It is a hardcoded admin:admin CouchDB account the appliance ships with, reachable once the SSRF gives you localhost.
• Exploitation ran from June 22 to at least July 2, 2026. SonicWall’s advisory landed July 14, and Volexity published on July 17.
• Attackers captured unencrypted LDAP traffic with tcpdump, lifting usernames and passwords, then attempted lateral movement. Rotate those credentials, not just the firmware.

What exactly was exploited?

CVE-2026-15409 is a pre-authentication server-side request forgery in the /wsproxy endpoint. Volexity documents unauthenticated WebSocket tunnelling to services bound on localhost, triggered with a malformed bmID=-3389 parameter and an SMA Connect Agent user-agent string. On its own it is a reachability bug: it lets an unauthenticated attacker talk to things the appliance never meant to expose.

RelatedMicrosoft Patches 570 Flaws, Two Zero-Days Exploited

What makes it decisive is what is listening. The appliance runs a CouchDB instance with hardcoded admin:admin credentials. Through the SSRF the attacker authenticated to it, read /sys/class/dmi/id/product_uuid, and staged malicious scripts on disk. Then CVE-2026-15410, a path traversal in sysCtrl.execRemoveHotfix, executed those staged payloads as root.

Read that chain again and note where the CVEs are. Two of the three links have identifiers and patches. The one in the middle is a shipped default credential on a security appliance, and it is the reason the other two compose into a full pre-auth root compromise rather than staying separate, lower-severity findings.

What did the attackers install?

The tooling is purpose-built for this appliance, which is the clearest sign this was not opportunistic scanning. Volexity names a Python dropper, KNUCKLEBALL (deploy_new.py), that injects Java instrumentation into legitimate SonicWall processes and persists by modifying the /etc/init.d/workplace startup script. It carries two embedded JARs. Suo5 (agent_wp8.jar) is an HTTP forwarding proxy derived from open-source code, gated on a user-agent fingerprint of Mozilla/6.0 (Windows NT 11.0; Win64; x64) so it stays inert for ordinary traffic. ORANGETAIL (agent_wp9.jar) is a custom Behinder-style webshell using hardcoded AES-128-ECB encryption and character-by-character string construction to frustrate static detection. A fourth component, ROOTRUN (xzfind), is a 13KB setuid binary that lets unprivileged commands run as root.

Running inside legitimate processes and keying the proxy to a specific user-agent means the appliance keeps working normally and the malware is quiet under casual inspection. Infrastructure was diffuse too: over 200 source IPs, including ExpressVPN and Mullvad exit nodes alongside assorted international addresses, which defeats simple IP blocklisting as a detection strategy.

Why is credential theft the real damage?

With root on the appliance, the attackers ran tcpdump and captured unencrypted LDAP traffic passing through it, which carried usernames and passwords in the clear, then attempted lateral movement into customer networks. That is the part that outlives the patch.

A VPN concentrator sits in the exact position where this is most damaging: it is internet-facing by design, it terminates authentication for remote users, and it talks to your directory service. Compromise it and you are not stealing one box, you are watching the front door’s key registry. Any incident response that stops at updating firmware leaves a working set of credentials in the attacker’s hands.

RelatedA Cisco Zero-Day Was Exploited for Two Months Before Anyone Knew

What should you actually do?

Patch to 12.4.3-03453 or 12.5.0-02835 first, on SMA 1000 series hardware and virtual appliances including the 6210, 7210 and 8200v. Then assume compromise for any appliance that was internet-facing between June 22 and the patch date, and hunt rather than trust.

1. Jun 22, 2026First observed compromise. UTA0533 exploiting both flaws as zero-days.
2. Jul 2, 2026Last observed attacker activity. Credential capture and lateral movement attempts.
3. Jul 14, 2026SonicWall advisory published. Confirms in-the-wild exploitation; patches available.
4. Jul 17, 2026Volexity publishes the technical analysis. Names UTA0533, the malware families and detection guidance.
5. NextCopycat exploitation. Public technical detail typically precedes commodity scanning within weeks.

Our take

Edge security appliances keep failing the same way, and the pattern is worth naming because it is not really about these two bugs. The device is internet-facing, it runs a sprawl of internal services that were designed assuming the network boundary would protect them, and one reachability bug collapses that assumption. The hardcoded admin:admin CouchDB account is the artifact to be angry about. It is not a coding mistake so much as an architectural bet that nothing untrusted would ever reach localhost, and CVE-2026-15409 is exactly the bug that voids that bet.

The three-week head start is the other lesson. Detection here did not come from the vendor or from signature-based tooling; it came from an incident response firm doing forensics on compromised appliances and working backwards. If your monitoring for edge devices consists of confirming they are patched, you would not have found this, because for three weeks there was nothing to patch. Log the appliance as though it were a server you expect to be attacked, keep the proxy logs long enough to look backwards, and treat every credential that passes through it as one breach away from public. This one is now on our CVE watchlist.

Original analysis by GenZTech. Technical detail from Volexity’s published research. Verify fixed versions against SonicWall’s advisory before patching.