Two zero-day vulnerabilities in SonicWall SMA1000 VPN appliances were exploited in an attack chain allowing threat actors to install custom malware. CVE-2026-15409 is a critical server-side request forgery (SSRF) vulnerability exploited via the '/wsproxy' endpoint to establish unauthenticated WebSocket tunnels to internal services like CouchDB and the management service. This access was used to obtain the appliance's product_uuid, a prerequisite for the second stage. CVE-2026-15410 is a high-severity command injection vulnerability in the Appliance Management Console's 'sysCtrl.execRemoveHotfix' RPC method, enabling root command execution. Using these, attackers deployed a malware dropper named KNUCKLEBALL, which installs two Java-based malware families: Sou5, a reverse proxy for covert traffic tunneling, and ORANGETAIL, a Java webshell for encrypted payload execution. The attackers also modified nginx configurations to expose the webshell and installed ROOTRUN for privilege escalation. SonicWall patched these vulnerabilities in versions 12.4.3-03453 and 12.5.0-02835 and advised immediate patching. The threat actor UTA0533 was active from at least June 22, 2026, exploiting these flaws before public disclosure. Despite the sophistication, lateral movement within victim networks was limited.

Exploitation of these vulnerabilities allows unauthenticated attackers to gain root-level control over SonicWall SMA1000 VPN appliances. This enables installation of custom malware that can maintain covert access, tunnel internal traffic, and execute arbitrary encrypted payloads remotely. The compromise of VPN appliances poses a significant risk to network security by potentially exposing internal resources and bypassing perimeter defenses. However, the attackers demonstrated limited success in spreading beyond the compromised devices. SonicWall confirmed active exploitation in the wild prior to patch availability.

SonicWall has released official patches addressing these vulnerabilities in SMA1000 versions 12.4.3-03453 and 12.5.0-02835. Customers should immediately apply these updates to mitigate the risk. No additional vendor-recommended mitigations are indicated. Patch status is confirmed as official-fix. Organizations should verify that affected appliances are updated to these versions or later to prevent exploitation.