CVE-2026-15409CampaignPublished 10 Sep 2026

Open directory exposes a full SonicWall SMA1000 credential-theft campaign: 250 targets, 5 domains fully replicated

Source Reddit ThreatIntel

Authoritative record:CVE-2026-15409· Critical 10.0

Exploited in the wild · KEV due 17 Jul 2026 · public exploit available (Metasploit) : block it and hunt for it in your logs now.

Data as of 10 Sep 2026, 17:52 UTC

CVSS base score

10.0Critical

How severe the flaw is on the 0–10 CVSS scale.

KEV deadline: 17 Jul 2026 US federal agencies must patch by this date; a sensible deadline for everyone else.

Exploitation evidence

t = 0 is the CVE’s publication on cve.org

Disclosed: evidence found.
CVE published 14 Jul 2026
Detectable: evidence found.
nuclei template: SonicWall SMA1000 - Server-Side Request Forgery
Weaponised: evidence found.
1 Metasploit module
Exploited in the wildExploited: evidence found.
Listed in CISA KEV the same day as disclosure
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

CVE ID reserved
by sonicwall
2026-07-1014:12Z, 4 days before disclosure
CVE published
on cve.org
2026-07-1419:39Z, t = 0
In Threat Radar
record ingested
2026-07-1420:03Z, 24 minutes after disclosure
Added to CISA KEV (opens in a new tab)
exploitation confirmed · ransomware use known
2026-07-14, the same day as disclosure
KEV remediation due
US federal deadline
2026-07-17, 3 days after disclosure

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
SonicWallSMA1000	Affected >=12.4.3-03245 <=12.4.3-03434 >=12.5.0-02283 <=12.5.0-02800	Fixed in–

Discussion

A threat actor exploited CVE-2026-15409, a critical unauthenticated server-side request forgery vulnerability in SonicWall SMA1000 appliances, to gain command execution and steal credentials. The attacker used a modified public proof-of-concept exploit to access internal Erlang services on the appliance, enabling remote code execution. This allowed extraction of LDAP configurations, Active Directory credentials, and deployment of tools to dump secrets from internal Windows systems. The campaign targeted at least 250 SonicWall SMA1000 devices across multiple countries and sectors, with confirmed credential theft in France, India, Italy, and the US. The attack leveraged compromised appliances as pivots into internal networks, exposing sensitive Active Directory data and enabling DCSync attacks against domain controllers. The targeting was opportunistic and technology-driven rather than sector-specific. The campaign was uncovered through an open directory left exposed by the attacker, providing a comprehensive view of the operation.

r/threatintel (opens in a new tab)u/Straight-Practice-990 points0 comments

The operator left their whole toolkit in an open directory, captured the same day it was still in use, which gave a fairly complete view of the campaign instead of a single victim.

Scope from the recovered files: 250 exploitable targets, LDAP config recovered from 168, 534 config records across 160 AD domains and 255 internal LDAP endpoints. SAM and LSA secrets from at least 9 domains, full DCSync against 7 DCs in 5 environments. Confirmed credential theft in France, India, Italy and the US, with the wider target list spanning the UK, Canada, Germany, Sweden, Poland, Hungary, South Korea and Hong Kong. Targeting looks opportunistic and technology-driven rather than sector-specific.

On attribution, several scripts carried extensive Chinese comments and logging, but that alone is not enough to attribute, so it is left open. One publicly reported victim, a UK council, lines up with the telemetry at moderate confidence. Full analysis and IOCs in the post.

https://hunt.io/blog/sonicwall-sma1000-uk-council-attack

Links cited in the discussion

https://hunt.io/blog/sonicwall-sma1000-uk-council-attack

Also discussed in r/Malware

Impact

The exploitation of CVE-2026-15409 allowed unauthenticated remote code execution on SonicWall SMA1000 appliances, leading to full credential theft campaigns against internal Active Directory environments. The attacker gained access to LDAP configurations and decrypted stored passwords, enabling lateral movement and extensive credential harvesting. The deployment of Impacket's secretsdump on appliances facilitated extraction of SAM and LSA secrets from Windows systems, and successful DCSync attacks against domain controllers exposed thousands of AD account records. This compromises the confidentiality and integrity of affected networks, potentially allowing persistent unauthorized access and further attacks. The campaign affected multiple countries and sectors, indicating a broad opportunistic threat.

Defensive guidance

SonicWall disclosed CVE-2026-15409 on July 14, 2026, assigning it a CVSS score of 10 and reporting active exploitation. Organizations using SonicWall SMA1000 appliances should apply the official patches provided by SonicWall immediately. Hunt.io notified relevant national CERTs and affected organizations ahead of public disclosure. Since the vulnerability enables unauthenticated remote code execution, patching is critical. Additionally, affected organizations should audit their SonicWall appliances for signs of compromise, review LDAP and Active Directory credentials, and monitor for unauthorized DCSync activity. The vendor manages remediation for this appliance; check SonicWall advisories for the latest updates and guidance.

Summary

The campaign exploited CVE-2026-15409, a critical SSRF vulnerability in SonicWall SMA1000 WorkPlace interface, disclosed on July 14, 2026, with a CVSS score of 10. The attacker used a modified Rapid7 proof-of-concept exploit to tunnel Erlang distribution protocol commands through a WebSocket proxy, authenticating with a hard-coded Erlang cookie to achieve OS command execution on the appliance. Post-exploitation scripts extracted LDAP configuration files and decrypted stored passwords, enabling access to internal Active Directory environments. A standalone Linux build of Impacket's secretsdump was deployed on compromised appliances to remotely extract SAM and LSA secrets from Windows systems. The attacker successfully performed DCSync attacks against seven domain controllers across five environments, exposing thousands of AD account records. The campaign affected at least 250 targets, spanning 160 AD domains and 255 internal LDAP endpoints, with victims in multiple countries including confirmed impacts in France, India, Italy, and the US. Attribution remains open, though some scripts contained Chinese comments. The campaign was identified by Hunt.io researchers from an open directory exposed by the attacker, providing detailed telemetry and indicators of compromise.

Metasploit modules

SonicWall SMA1000 WorkPlace wsproxy SSRF Remote Command Executionexploit · Excellent (opens in a new tab)

Nuclei detection templates

SonicWall SMA1000 - Server-Side Request Forgerycritical (opens in a new tab)

Public tooling indexed from Metasploit Framework, Exploit-DB and ProjectDiscovery nuclei-templates. Its existence raises the odds of exploitation; it does not confirm attacks.

References

Community reviews

Loading reviews…

Exploitation evidence

Timeline

What to do

Affected software

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 10 Sep 2026, 17:52 UTC

Public exploits and detection1 Metasploit module, a Nuclei detection template

Technical details

References

Community reviews

Related threats