SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access

# SonicWall SMA 1000 Zero-Days Chained for Root Access — Exploited Since June Before Patches Existed

## The Threat

A previously unknown threat actor has been actively exploiting two zero-day vulnerabilities in SonicWall's Secure Mobile Access (SMA) 1000 series VPN appliances since at least June 22, 2026 — nearly a month before SonicWall released patches this week. Volexity, which uncovered the activity during an incident response engagement, is tracking the actor as UTA0533. The identity of the compromised organization has not been disclosed.

The attack chain is surgical and deliberate. CVE-2026-15409, a pre-authentication WebSocket proxy bypass scored at a perfect 10.0, lets an unauthenticated attacker tunnel requests to localhost-only services on the appliance. That foothold feeds directly into CVE-2026-15410, a command injection and privilege escalation flaw in the SMA control service. Chained together, the two vulnerabilities deliver full root access to a device that sits at the perimeter of enterprise networks — and in many cases acts as the sole gateway for remote workforce authentication.

What makes this campaign especially alarming is the malware toolkit UTA0533 brought to the operation. Researchers Sean Koessel and Steven Adair documented purpose-built implants, an open-source HTTP proxy tunneled through legitimate SonicWall processes, and credential harvesting infrastructure targeting LDAP authentication. This was not opportunistic scanning. The actor had done their homework on the SMA platform's internals before any public vulnerability information existed.

## Severity and Impact

| CVE | CVSS Score | CVSS Vector | Attack Complexity | Auth Required | CWE |

|-----|------------|-------------|-------------------|---------------|-----|

| CVE-2026-15409 | 10.0 (Critical) | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | Low | None | CWE-288 (Authentication Bypass) |

| CVE-2026-15410 | 7.2 (High) | AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | Low | High (escalated via chaining) | CWE-78 (OS Command Injection) |

CVE-2026-15409 is the entry point and the critical one: zero authentication, no user interaction, full network exposure. The exploit involves sending a request with a User-Agent of SMA Connect Agent and a bmID value prefixed with -3389, which bypasses the /wsproxy endpoint's access controls and opens a WebSocket tunnel to internal services. From there, CVE-2026-15410 handles the command injection that completes the takeover.

## Affected Products

- SMA 6200

- SMA 6210

- SMA 7200

- SMA 7210

- SMA 8200v (virtual)

SonicWall's SMA 100 series is not confirmed affected by this specific campaign. Organizations running SMA 1000 series devices should treat all unpatched instances as potentially compromised rather than simply unpatched.

## Mitigations

Patch immediately. SonicWall released fixes this week for both CVEs. Given active exploitation dating back to late June, patching alone is not sufficient — incident response procedures should accompany any update.

Assume breach if you're unpatched. Any SMA 1000 appliance that was internet-exposed between June 22 and the patch date should be treated as potentially compromised. Volexity found that a reboot of Appliance 2 on July 2 cleared memory-resident artifacts and backdoors, but disk-resident malware on Appliance 1 survived. Rebooting is not a reliable remediation path.

Check these specific indicators:

Monitor LDAP traffic. UTA0533 deployed tcpdump via lib.sh to capture unencrypted LDAP authentication traffic and harvest credentials in cleartext. Any organizations running LDAP over port 389 through or adjacent to SMA appliances should audit logs for unauthorized packet capture activity.

Network segmentation. SMA appliances should not have unrestricted internal access. If VPN termination devices can pivot freely into internal authentication infrastructure, the blast radius of any future compromise expands significantly.

## References

---

## HackWire Analysis

The UTA0533 campaign against SonicWall SMA 1000 appliances fits a pattern that's become disturbingly routine: sophisticated actors acquiring zero-days in edge devices, deploying them quietly for weeks before any public awareness, and building persistent footholds that survive even vendor patches. We've seen this playbook with Ivanti Connect Secure, Fortinet FortiGate, Citrix Bleed, and Pulse Secure before them. The perimeter VPN appliance has become the most valuable real estate in enterprise intrusion — and vendors keep shipping products with fundamental pre-authentication flaws that cost CVSS 10.0 because the underlying access models weren't designed with adversarial pressure in mind.

What distinguishes this campaign from a generic exploitation wave is the tooling investment. ROOTRUN and KNUCKLEBALL aren't cobbled-together scripts — they're purpose-built for SonicWall's specific runtime environment, embedding JAR archives injected into legitimate processes and routing attacker traffic through the appliance's own web server configuration. That level of platform familiarity doesn't come from a week of poking. UTA0533 had meaningful prior access to SMA internals, whether through legal channels, leaked firmware, or extended prior research. The LDAP credential harvesting is the operational kicker: this actor isn't after the VPN device, they're after the identity infrastructure behind it.

The June 22 first-seen date is the number that should keep security teams up at night. Four weeks of dwell time in a device that authenticates your entire remote workforce. Defenders who haven't yet checked their SMA 1000 boxes for the indicators Volexity published aren't behind on patching — they're behind on triage.

— HackWire Editorial

## Related Coverage