SonicWall SMA 1000 Zero-Days Exploited to Install Custom Malware

Attackers exploited two zero-day vulnerabilities in SonicWall Secure Mobile Access 1000 appliances to obtain root access, install custom malware, capture network traffic, and attempt to enter internal systems. The flaws are tracked as CVE-2026-15409 and CVE-2026-15410.

SonicWall’s security notice confirms that both vulnerabilities were actively exploited before fixes became available. Organizations should install hotfix 12.4.3-03453 or 12.5.0-02835, depending on the firmware branch in use.

Incident response company Volexity traced the attacks to a previously undocumented threat actor it calls UTA0533. The earliest confirmed compromise occurred on June 22, 2026. The US Cybersecurity and Infrastructure Security Agency also added both flaws to its Known Exploited Vulnerabilities catalog on July 14.

Which SonicWall Products and Versions Are Affected?

The vulnerabilities affect physical and virtual SonicWall SMA 1000 deployments. SonicWall lists the SMA 6210, SMA 7210, SMA 8200v, and Central Management Server deployments across all supported hypervisors.

Product	Affected firmware	Fixed firmware
SMA 6210, 7210, 8200v and CMS	12.4.3-03245, 12.4.3-03387 and 12.4.3-03434	12.4.3-03453 or later
SMA 6210, 7210, 8200v and CMS	12.5.0-02283, 12.5.0-02624 and 12.5.0-02800	12.5.0-02835 or later

CVE-2026-15409 has a CVSS score of 10.0 and affects the SMA Workplace interface. It is a server-side request forgery vulnerability that can be exploited remotely without authentication.

CVE-2026-15410 has a CVSS score of 7.2. SonicWall describes it as a post-authentication code-injection vulnerability in the Appliance Management Console. When combined with the first flaw and weaknesses in internal services, it can help an attacker execute operating-system commands with elevated privileges.

How the SonicWall Zero-Day Attack Works

The attack begins with CVE-2026-15409. UTA0533 abused the internet-facing /wsproxy endpoint to create WebSocket connections to services that should only have been reachable from the appliance itself.

The attacker connected to CouchDB on port 1050 and the SMA control service on port 8188. Forensic evidence indicates that the CouchDB account was used to write and execute a script that read the appliance’s hardware UUID. That value could then be used to access privileged control-service functions.

The attackers subsequently exploited CVE-2026-15410 through the hotfix-removal workflow. Path-traversal input supplied to the removal function caused a malicious script outside the expected rollback directory to run as root.

Attack stage	Observed activity
Initial access	Unauthenticated requests to the /wsproxy endpoint
Internal service access	WebSocket connections to ports 1050 and 8188
Privilege escalation	Path traversal through the hotfix-removal process
Persistence	Startup-script and NGINX Unit configuration changes
Credential collection	Packet capture targeting unencrypted LDAP traffic

UTA0533 Deploys ROOTRUN and KNUCKLEBALL Malware

On one compromised appliance, UTA0533 installed an ELF executable named xzfind in the /usr/bin directory. Volexity named the utility ROOTRUN because it contained that internal name. The setuid binary allowed an unprivileged user to execute commands as root.

The attackers also placed a Python script named deploy_new.py in a Python site-packages directory. Volexity calls this malware KNUCKLEBALL. It injected two embedded Java archives into a legitimate SonicWall process, allowing the malicious components to operate from memory.

The two injected components were Suo5, an open-source HTTP proxy tool, and ORANGETAIL, a custom Java web shell similar to Behinder. The attacker added KNUCKLEBALL to the appliance’s Workplace startup script so it would run again after a reboot.

• ROOTRUN provided a direct way to execute commands with root privileges.
• KNUCKLEBALL loaded malicious Java components into a legitimate process.
• Suo5 forwarded traffic through the compromised VPN appliance.
• ORANGETAIL provided remote web-shell access.
• Modified startup and web-server configurations maintained access.

Hidden Web Routes and Credential Capture

UTA0533 changed the NGINX Unit configuration at /var/lib/unit/conf.json. Requests to /__api__/login and /__api__/logout were redirected to malicious services listening on 127.0.0.1:8085.

The backdoors accepted requests only when they contained a specific invalid browser user-agent string. This condition reduced the chance that routine browsing or automated checks would expose the malicious endpoints.

On a second appliance, investigators found a script that launched tcpdump to record unencrypted LDAP traffic on TCP port 389. The apparent objective was to capture credentials passing between the SMA appliance and internal directory servers.

Indicators of SonicWall SMA Compromise

The detailed Volexity investigation includes hashes, log examples, filenames, YARA rules, and other hunting information. Security teams should preserve appliance logs and disk evidence before rebuilding a suspected device.

Location or indicator	What defenders should investigate
/var/log/aventail/extraweb_access.log	Suspicious /wsproxy requests returning HTTP 101
/var/log/aventail/ctrl-service.log	Hotfix-removal entries containing path-traversal sequences
/var/lib/unit/conf.json	Unexpected routes for /__api__/login or /__api__/logout
/usr/bin/xzfind	ROOTRUN setuid executable
deploy_new.py	KNUCKLEBALL Python loader
/tmp and /var/tmp	Unexpected scripts, packet captures, executables, or encoded files

Teams should also look for unexpected connections originating from an SMA appliance, unusual authentication attempts against internal systems, unapproved setuid binaries, and traffic captures involving LDAP or other authentication protocols.

What SonicWall Customers Should Do Now

The current SonicWall remediation guidance tells every organization running an affected SMA 1000 version to install the latest hotfix and complete a forensic review. Updating closes the vulnerabilities but does not remove malware or persistence installed before the update.

1. Upgrade to firmware 12.4.3-03453, 12.5.0-02835, or a later supported release.
2. Review web-access, control-service, authentication, and system logs.
3. Inspect configuration files, temporary directories, startup scripts, and setuid binaries.
4. Re-image affected physical appliances or redeploy affected virtual appliances when compromise indicators are found.
5. Change all administrator and user passwords associated with the appliance.
6. Reset time-based one-time password tokens.
7. Investigate suspicious authentication attempts and lateral movement from the appliance.
8. Rotate credentials that may have crossed the device or appeared in captured traffic.

CISA assigned both vulnerabilities a July 17, 2026 remediation deadline for US federal civilian agencies. Their inclusion in the CISA exploitation alert also gives private organizations a clear reason to treat these updates as emergency work.

Organizations that find indicators should avoid restoring configuration backups created after the potentially compromised firmware was installed. SonicWall recommends using a backup that predates the December hotfix versions, where available, or closely auditing the configuration for unauthorized changes.

Why the SonicWall Attacks Create Wider Network Risk

SMA appliances process remote-access sessions and can handle credentials used to reach sensitive internal resources. Root access therefore gives an attacker a valuable position for surveillance, credential interception, and network entry.

Volexity found that UTA0533 demonstrated strong appliance-exploitation skills but had less success moving laterally to other systems in the investigated environment. That finding should not reduce the urgency of incident response because other victims may have different network controls or exposure.

Any organization that operated a vulnerable, internet-accessible SMA 1000 appliance should investigate whether exploitation occurred before patching. A clean firmware version confirms that the vulnerabilities were repaired. It does not prove that the appliance or connected accounts were never compromised.

FAQ