top of page

Active Exploitation of Chained Zero-Day Vulnerabilities in SonicWall SMA1000 Series Appliances (CVE-2026-15409, CVE-2026-15410)

July 24th, 2026

Critical

Our Cyber Threat Intelligence Unit is monitoring two chained zero-day vulnerabilities affecting SonicWall SMA1000 Series remote access appliances, tracked as CVE-2026-15409 and CVE-2026-15410, disclosed by SonicWall on July 14, 2026. CVE-2026-15409 is a maximum-severity (CVSS 10.0) unauthenticated server-side request forgery vulnerability in the SMA1000 Appliance Work Place interface that allows a remote attacker, without credentials or user interaction, to open a network tunnel to the appliance's internal-only services. Attackers are chaining this access with CVE-2026-15410, a high-severity (CVSS 7.2) code injection vulnerability in the Appliance Management Console, to reach an internal service on the appliance and execute arbitrary operating system commands as root. Rapid7's Managed Detection and Response team observed active, targeted exploitation of internet-facing SMA1000 appliances before SonicWall's public disclosure. Attackers harvested credentials, session databases, and TOTP MFA seed configurations to maintain persistent access before pivoting into internal Active Directory environments. CISA has added both CVEs to its Known Exploited Vulnerabilities catalog under Binding Operational Directive 22-01, with a Federal Civilian Executive Branch remediation deadline of July 17, 2026. No workarounds are available; organizations must apply the available hotfix releases immediately.

Technical Details

  • Threat Type: Chained remote code execution combining an unauthenticated server-side request forgery vulnerability (CVE-2026-15409) with a post-authentication code injection vulnerability (CVE-2026-15410).

  • Severity: Critical.

  • CVE IDs: CVE-2026-15409, CVE-2026-15410.

  • CVSS Scores: 10.0 CRITICAL for CVE-2026-15409 and 7.2 HIGH for CVE-2026-15410 (SonicWall CNA); NVD independent scores not yet published.

  • Weakness Types: CWE-918 Server-Side Request Forgery (CVE-2026-15409); CWE-94 Improper Control of Generation of Code, Code Injection (CVE-2026-15410).

  • Affected Systems: SonicWall SMA1000 Series appliances, models 6210, 7210, and 8200v.

  • Threat Actors: Not attributed to a named group at time of disclosure.

  • Exploit Status: Actively exploited in the wild; both CVEs added to the CISA Known Exploited Vulnerabilities catalog.


Affected Products and Versions:

  • SMA1000 Series (6210, 7210, 8200v), 12.4.3 branch: Affected versions 12.4.3-03245 through 12.4.3-03434; fixed in 12.4.3-03453 (platform-hotfix) or later.

  • SMA1000 Series (6210, 7210, 8200v), 12.5.0 branch: Affected versions 12.5.0-02283 through 12.5.0-02800; fixed in 12.5.0-02835 (platform-hotfix) or later.


Attack Chain:

  • Initial Access: Attackers connect to the SMA1000 WorkPlace websocket proxy (/wsproxy), served on port 443, which accepts connections without authentication.

  • Internal Tunnel (CVE-2026-15409): The attacker directs the proxy to open a tunnel to localhost-only services on the appliance, such as the Erlang process on port 1050, achieving code execution without valid credentials.

  • Privilege Escalation (CVE-2026-15410): Using the foothold gained through the tunnel (or, alternatively, an authenticated admin session), the attacker reaches the internal ctrl-service on port 8188 and submits a path traversal value to the hotfix-removal workflow, causing the appliance to execute an attacker-supplied script as root.

  • Persistence and Credential Harvesting: With root access established, attackers extract stored credentials, active session databases, and TOTP MFA seed configurations from the appliance.

  • Lateral Movement: Attackers use the harvested LDAP service-account context to authenticate directly to internal Active Directory domain controllers from the appliance's internal IP address, bypassing the VPN tunnel entirely and using atypical client names such as "kali."

Image by ThisisEngineering

Impact

  • Perimeter and Credential Compromise: Full root-level compromise of the appliance allows attackers to harvest administrator credentials, VPN session data, and TOTP MFA seeds.

  • Lateral Movement into Internal Networks: Harvested credentials and the appliance's integrated LDAP service account allow direct, VPN-less authentication to internal Active Directory domain controllers.

  • Regulatory Exposure: Both CVEs are listed in the CISA KEV catalog; federal civilian agencies must remediate by July 17, 2026 under Binding Operational Directive 22-01, and other organizations face compliance risk if left unpatched.

  • Operational Impact: Confirmed compromise may require re-imaging physical appliances or redeploying virtual appliances, along with a full credential and TOTP reset.

  • Reputational and Business Impact: Public disclosure of active exploitation, combined with confirmed lateral movement into corporate networks, increases the risk of data exposure and downstream business disruption.

Detection Method

  • Review extraweb_access.log for GET requests to /wsproxy containing "=-3389" and returning HTTP 101; host parameter values such as "localhost" or "::ffff:127.0.0.1" indicate likely exploitation of CVE-2026-15409.

  • Review ctrl-service.log for invocations of /usr/local/bin/remove_hotfix containing path traversal sequences (e.g., ../../../../../../tmp/) pointing to attacker-staged scripts, indicating exploitation of CVE-2026-15410.

  • Monitor for anomalous, VPN-less Active Directory authentications to domain controllers originating from the SMA1000 appliance's internal IP address, particularly using non-corporate workstation client names such as "kali."

  • Review Windows Event ID 4624 (logon type 3, NTLM) for domain controller logons sourced from the appliance's internal IP address without a corresponding active VPN session.

  • Audit the appliance configuration file /var/lib/unit/conf.json for routes referencing /__api__/login or /__api__/logout that are not present in a legitimate baseline configuration.

  • Review access to /tmp/temp.db* on the appliance, which is consistent with theft of stored session data.

  • Validate SIEM and EDR detection coverage against the log patterns and indicators in this advisory using breach and attack simulation testing.

Indicators of Compromise

Type

Indicator

Description

IP Range

45.131.194[.]0/24

Source range observed in SMA1000 exploitation activity (FNS Holdings Limited, ASN 206092)

IP Range

45.146.54[.]0/24

Source range observed in SMA1000 exploitation activity (FNS Holdings Limited, ASN 206092)

IP Range

63.135.161[.]0/24

Source range observed in SMA1000 exploitation activity (FNS Holdings Limited, ASN 206092)

IP Range

173.239.211[.]0/24

Source range observed in SMA1000 exploitation activity (FNS Holdings Limited, ASN 206092)

IP Address

193.37.32[.]179

Source IP observed in SMA1000 exploitation activity (FNS Holdings Limited)

IP Address

193.37.32[.]214

Source IP observed in SMA1000 exploitation activity (FNS Holdings Limited)

IP Address

216.73.163[.]151

Source IP observed in SMA1000 exploitation activity (FNS Holdings Limited)

IP Address

216.73.163[.]158

Source IP observed in SMA1000 exploitation activity (FNS Holdings Limited)

Hostname

DESKTOP-KRLUI3J

Attacker-controlled workstation name observed in anomalous Active Directory authentication

Hostname

DESKTOP-IC3C80F

Attacker-controlled workstation name observed in anomalous Active Directory authentication

Hostname

DESKTOP-5P0TSCP

Attacker-controlled workstation name observed in anomalous Active Directory authentication

Hostname

KALI

Attacker-controlled workstation name observed in anomalous Active Directory authentication


mix of red, purple, orange, blue bubble shape waves horizontal for cybersecurity and netwo

Recommendations

  • Upgrade all SMA1000 appliances (models 6210, 7210, 8200v) to platform-hotfix 12.4.3-03453 or 12.5.0-02835, or later, immediately. No workarounds are available.

  • Treat any appliance matching the indicators above, or the log patterns in Detection Methods, as compromised.

  • Re-image physical appliances or redeploy virtual appliances where compromise is confirmed or suspected.

  • Reset all user and administrator passwords and TOTP MFA tokens on affected appliances.

  • Conduct a forensic review of Active Directory for anomalous, VPN-less authentications originating from the appliance's internal IP address.

  • Implement network segmentation to limit the blast radius if an SMA1000 appliance is compromised.

  • Ensure SIEM and EDR detection rules cover the log patterns and indicators identified in this advisory, and validate coverage with breach and attack simulation testing.

  • Enforce multi-factor authentication for all remote access and monitor for unusual administrative console activity.

Conclusion

The active exploitation of CVE-2026-15409 and CVE-2026-15410 represents an urgent threat to organizations running SonicWall SMA1000 Series appliances. The chained attack requires no credentials, no user interaction, and no prior access, turning any internet-facing appliance running an affected version into a direct entry point into the corporate network. Rapid7's observation of exploitation preceding SonicWall's disclosure, combined with confirmed credential and TOTP seed harvesting and direct Active Directory lateral movement, indicates a targeted threat actor with objectives extending beyond the appliance itself. A public proof-of-concept for the first-stage vulnerability is already available, which is likely to widen exploitation to opportunistic attackers. Organizations must patch immediately, review appliance logs against the indicators in this advisory, and be prepared to re-image and fully reset credentials on any device where compromise is confirmed.

bottom of page