SonicWall SMA1000 flaws exploited as zero-days to push custom malware
Two zero-day vulnerabilities in SonicWall SMA1000 VPN appliances were exploited in the wild to install custom malware. The flaws, CVE-2026-15409 (critical SSRF) and CVE-2026-15410 (high-severity command injection), affect SMA1000 6210, 7210, and 8200v models. Attackers used an exploit chain to gain root access and deploy malware families Sou5 and ORANGETAIL, enabling covert access and remote command execution. SonicWall released patches in versions 12.4.3-03453 and 12.5.0-02835 and urged immediate updates. The threat actor, tracked as UTA0533, exploited these flaws starting June 22, 2026, before public disclosure. While technically sophisticated, the attackers had limited success spreading internally. The vendor confirmed active exploitation but did not disclose full attack details.
AI Analysis
Technical Summary
Two zero-day vulnerabilities in SonicWall SMA1000 VPN appliances were exploited in an attack chain allowing threat actors to install custom malware. CVE-2026-15409 is a critical server-side request forgery (SSRF) vulnerability exploited via the '/wsproxy' endpoint to establish unauthenticated WebSocket tunnels to internal services like CouchDB and the management service. This access was used to obtain the appliance's product_uuid, a prerequisite for the second stage. CVE-2026-15410 is a high-severity command injection vulnerability in the Appliance Management Console's 'sysCtrl.execRemoveHotfix' RPC method, enabling root command execution. Using these, attackers deployed a malware dropper named KNUCKLEBALL, which installs two Java-based malware families: Sou5, a reverse proxy for covert traffic tunneling, and ORANGETAIL, a Java webshell for encrypted payload execution. The attackers also modified nginx configurations to expose the webshell and installed ROOTRUN for privilege escalation. SonicWall patched these vulnerabilities in versions 12.4.3-03453 and 12.5.0-02835 and advised immediate patching. The threat actor UTA0533 was active from at least June 22, 2026, exploiting these flaws before public disclosure. Despite the sophistication, lateral movement within victim networks was limited.
Potential Impact
Exploitation of these vulnerabilities allows unauthenticated attackers to gain root-level control over SonicWall SMA1000 VPN appliances. This enables installation of custom malware that can maintain covert access, tunnel internal traffic, and execute arbitrary encrypted payloads remotely. The compromise of VPN appliances poses a significant risk to network security by potentially exposing internal resources and bypassing perimeter defenses. However, the attackers demonstrated limited success in spreading beyond the compromised devices. SonicWall confirmed active exploitation in the wild prior to patch availability.
Mitigation Recommendations
SonicWall has released official patches addressing these vulnerabilities in SMA1000 versions 12.4.3-03453 and 12.5.0-02835. Customers should immediately apply these updates to mitigate the risk. No additional vendor-recommended mitigations are indicated. Patch status is confirmed as official-fix. Organizations should verify that affected appliances are updated to these versions or later to prevent exploitation.
SonicWall SMA1000 flaws exploited as zero-days to push custom malware
Description
Two zero-day vulnerabilities in SonicWall SMA1000 VPN appliances were exploited in the wild to install custom malware. The flaws, CVE-2026-15409 (critical SSRF) and CVE-2026-15410 (high-severity command injection), affect SMA1000 6210, 7210, and 8200v models. Attackers used an exploit chain to gain root access and deploy malware families Sou5 and ORANGETAIL, enabling covert access and remote command execution. SonicWall released patches in versions 12.4.3-03453 and 12.5.0-02835 and urged immediate updates. The threat actor, tracked as UTA0533, exploited these flaws starting June 22, 2026, before public disclosure. While technically sophisticated, the attackers had limited success spreading internally. The vendor confirmed active exploitation but did not disclose full attack details.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Two zero-day vulnerabilities in SonicWall SMA1000 VPN appliances were exploited in an attack chain allowing threat actors to install custom malware. CVE-2026-15409 is a critical server-side request forgery (SSRF) vulnerability exploited via the '/wsproxy' endpoint to establish unauthenticated WebSocket tunnels to internal services like CouchDB and the management service. This access was used to obtain the appliance's product_uuid, a prerequisite for the second stage. CVE-2026-15410 is a high-severity command injection vulnerability in the Appliance Management Console's 'sysCtrl.execRemoveHotfix' RPC method, enabling root command execution. Using these, attackers deployed a malware dropper named KNUCKLEBALL, which installs two Java-based malware families: Sou5, a reverse proxy for covert traffic tunneling, and ORANGETAIL, a Java webshell for encrypted payload execution. The attackers also modified nginx configurations to expose the webshell and installed ROOTRUN for privilege escalation. SonicWall patched these vulnerabilities in versions 12.4.3-03453 and 12.5.0-02835 and advised immediate patching. The threat actor UTA0533 was active from at least June 22, 2026, exploiting these flaws before public disclosure. Despite the sophistication, lateral movement within victim networks was limited.
Potential Impact
Exploitation of these vulnerabilities allows unauthenticated attackers to gain root-level control over SonicWall SMA1000 VPN appliances. This enables installation of custom malware that can maintain covert access, tunnel internal traffic, and execute arbitrary encrypted payloads remotely. The compromise of VPN appliances poses a significant risk to network security by potentially exposing internal resources and bypassing perimeter defenses. However, the attackers demonstrated limited success in spreading beyond the compromised devices. SonicWall confirmed active exploitation in the wild prior to patch availability.
Mitigation Recommendations
SonicWall has released official patches addressing these vulnerabilities in SMA1000 versions 12.4.3-03453 and 12.5.0-02835. Customers should immediately apply these updates to mitigate the risk. No additional vendor-recommended mitigations are indicated. Patch status is confirmed as official-fix. Organizations should verify that affected appliances are updated to these versions or later to prevent exploitation.
Technical Details
- Article Source
- {"url":"https://www.bleepingcomputer.com/news/security/sonicwall-sma1000-flaws-exploited-as-zero-days-to-push-custom-malware/","fetched":true,"fetchedAt":"2026-07-20T22:26:48.034Z","wordCount":883}
Threat ID: 6a5ea0a82a4a8d5989daab0f
Added to database: 07/20/2026, 22:26:48 UTC
Last enriched: 07/20/2026, 22:26:57 UTC
Last updated: 07/21/2026, 05:43:19 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.