SonicWall SMA 1000 Under Attack: CVE-2026-15409 CVSS 10.0 and…

CVE-2026-15409 and CVE-2026-15410 exposed SonicWall SMA 1000 appliances to unauthenticated root compromise. The theft of MFA seeds renders standard password resets insufficient.

On June 22, 2026, a threat actor designated UTA0533 by Volexity began exploiting two zero-day vulnerabilities in SonicWall SMA 1000 VPN appliances, achieving credential-less root access. Twenty-two days later, on July 13-14, 2026, SonicWall released patches; on July 14, CISA added both CVEs to the KEV catalog with a federal deadline of July 17. By mid-August, INC ransomware remains the primary post-disclosure actor, and a stubborn operational problem continues to divide incident responders: the theft of TOTP seeds, which turns the classic password reset into a symbolic gesture.

Key Takeaways

CVE-2026-15409 (CVSS 10.0, SSRF in /wsproxy) and CVE-2026-15410 (CVSS 7.2, path traversal in remove_hotfix) chain for unauthenticated remote code execution as root, per NVD entries and Rapid7 analysis.
Exfiltration of TOTP/MFA seeds allows attackers to regenerate valid time-based codes even after patching, making password rotation alone insufficient in incident response procedures.
CISA mandated federal agencies to remediate the vulnerabilities by July 17, 2026 via BOD 26-04; on August 10, 2026, CISA flagged both CVEs as exploited in ransomware campaigns.
Rapid7 observed lateral movement to Active Directory via authentications without VPN tunnels, leveraging the appliance's integrated LDAP account with anomalous workstation names such as "kali".

The Exploit Chain: From /wsproxy to Root

The technical core is a pre-authentication Server-Side Request Forgery in the /wsproxy component of the SMA 1000. Rapid7, whose MDR team discovered the active exploitation and published a proof-of-concept, describes the mechanism as follows: "With this capability, an attacker can reach and exploit less-hardened services running on the appliance, such as the Erlang application on localhost:1050 or the ctrl-service application on localhost:8188". The WebSocket tunnels to services exposed only on localhost, bypassing perimeter protections.

From there, the second link in the chain: CVE-2026-15410 in the ctrl-service remove_hotfix workflow. The path traversal allows execution of attacker-controlled scripts with root privileges. Rapid7 documents the concrete sequence: ../../../../tmp/1234.sh executed as root. The National Vulnerability Database records CVE-2026-15409 with a CVSS 10.0 score and vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; CVE-2026-15410 with CVSS 7.2 and vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, both with CISA-ADP scores.

The Two Actors: UTA0533 and INC Ransomware

Volexity assigned the designation UTA0533 to the cluster responsible for pre-disclosure exploitation. Researchers Sean Koessel and Steven Adair state: "UTA0533 combined multiple zero-day vulnerabilities to compromise SonicWall SMA VPN appliances and obtain root-level access". Associated malware includes ROOTRUN (xzfind, setuid escalation), KNUCKLEBALL (deploy_new.py, Python loader with embedded JAR), Suo5 (HTTP proxy), and ORANGETAIL (custom Java web shell).

Following patch release, INC ransomware emerged as the dominant actor. Douglas McKee, Rapid7's director of vulnerability intelligence, confirms: "More recently, INC Ransomware has emerged as the dominant threat actor actively weaponizing this vulnerability chain". The group is known for extortion tactics involving direct phone calls to victims. Resecurity identified victims posted on a data leak site between July 17 and August 1, 2026, though without quantifying the total number of organizations hit.

"More recently, INC Ransomware has emerged as the dominant threat actor actively weaponizing this vulnerability chain" — Douglas McKee, Rapid7

The Operational Problem: TOTP Seeds and the Reset Theater

This is the critical angle for incident response managers. Rapid7 documents that attackers "systematically extracted...Time-Based One-Time Password (TOTP) multi-factor authentication (MFA) seed configurations". Resecurity specifies these are "secret values that generate one-time passcodes". This is not theft of valid tokens, which would expire in seconds; it is exfiltration of the secret material that generates the tokens, enabling the attacker to produce valid TOTP codes at will.

The consequence is that the classic incident response playbook — password resets, session revocation, patching — leaves a door open. Until TOTP seeds are regenerated (re-seeding), two-factor authentication continues to grant access to the attacker. SonicWall explicitly recommends, per BleepingComputer, re-imaging compromised appliances, resetting all passwords, and regenerating TOTP tokens. The recommendation is not a cautious add-on; it is the direct consequence of a documented technical fact.

Immediate Actions

Priority actions emerge from the verified facts of this dossier:

Update firmware to patched versions: SonicWall released 12.4.3-03453+ and 12.5.0-02835+; no alternative workarounds exist, per the vendor advisory cited by BleepingComputer.
Rebuild compromised appliances: Re-imaging is recommended by the vendor to eliminate potential persistence established during the exploitation window.
Complete reset of passwords and TOTP seeds: Password rotation alone is insufficient; MFA seeds must be regenerated to prevent authentication with attacker-generated codes.
Verify anomalous authentications in Active Directory: Rapid7 observed LDAP authentications without VPN tunnels from internal appliance IP addresses; check logs for workstation names non-conforming to corporate naming conventions.

Gaps in the Picture

The dossier leaves significant open questions. It is unclear whether UTA0533 and INC ransomware represent the same group or distinct actors with shared tooling access; Rapid7 suggests a "single threat actor or coordinated group" for the zero-day discovery phase, but INC could be a post-disclosure adopter. The total victim count is not consistently quantified across sources. It is undocumented whether the hardcoded CouchDB credentials "admin:admin" mentioned in some analyses were actually exploited in observed incidents; Volexity indicates they were not in the UTA0533 campaign.

A technical uncertainty concerns virtual models: the SMA 8200v might be exploitable via a product_uuid bypass that, per Volexity, affects only physical devices. The patch adoption rate as of August 2026 is not available numerically, though Resecurity reports many appliances remain vulnerable.

The SonicWall SMA 1000 case serves as a benchmark for a verification that incident response procedures must incorporate: when the VPN itself becomes the compromise vector, credential regeneration is no longer a formality. A password reset without TOTP re-seeding is a gesture that leaves attacker access intact.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references