SonicWall SMA1000: Active Zero-Days Enable Lateral Movement…

Two zero-day vulnerabilities in SonicWall SMA1000 allow unauthenticated RCE and lateral movement to Active Directory without VPN tunnels. CISA mandates remediation deadline.

SonicWall disclosed two zero-day vulnerabilities in the SMA1000 series on July 14, 2026 that are actively exploited in targeted attacks. The exploit chain enables unauthenticated remote code execution, full appliance compromise, and lateral movement to Active Directory bypassing VPN session logs. CISA has added both CVEs to the KEV catalog with a remediation deadline for federal agencies set for July 17, 2026.

Key Takeaways

CVE-2026-15409 is an SSRF vulnerability with a CVSS score of 10.0 that allows an unauthenticated remote attacker to tunnel traffic to localhost-only services on the appliance.
CVE-2026-15410 is a code injection vulnerability with CVSS 7.2 that, when chained with the first, leads to arbitrary command execution as root.
Rapid7 MDR and Volexity have documented custom malware (KNUCKLEBALL, Sou5, ORANGETAIL) and "VPN-less" lateral movement to Active Directory via the appliance's LDAP service account.
The first observed compromise dates to June 22, 2026; available patches are firmware versions 12.4.3-03453 and 12.5.0-02835.

The Technical Chain: From SSRF to Root in Two Steps

The attack surface is the /wsproxy endpoint of the Appliance Work Place interface, a WebSocket proxy that SonicWall had not properly isolated from the internal management plane. According to Rapid7's analysis, an unauthenticated remote attacker exploits CVE-2026-15409 to tunnel requests to services listening only on localhost: specifically CouchDB on port 1050 and the ctrl-service on port 8188.

From the CouchDB response the attacker extracts the product_uuid, an identifier required to authenticate to the Appliance Management Console. With these temporary credentials they access the AMC and exploit CVE-2026-15410, a code injection vulnerability in the remove_hotfix workflow that accepts user-supplied paths without sanitization. Through a directory traversal, the attacker forces execution of an arbitrary script with root privileges.

Volexity, reported by BleepingComputer, documented this same chain in response to incidents attributed to threat actor UTA0533. The date of first observed compromise is June 22, 2026, approximately three weeks before public disclosure.

Malware and Persistence: The Appliance as an Internal Backdoor

After initial compromise, threat actors deployed multiple families of custom Java malware. Volexity identified KNUCKLEBALL as the initial dropper, which in turn installs Sou5 — a reverse proxy that maintains persistent remote access — and ORANGETAIL, a Java webshell for arbitrary command execution. ROOTrun is an additional privilege escalation tool detected in the same incidents.

Mechanical persistence includes modification of the nginx configuration to expose internal services externally. This mechanism turns the compromised appliance into a stable foothold inside the network perimeter, with communications that can masquerade as legitimate web traffic.

"Threat actors were primarily leveraging the perimeter appliance as a stealthy initial access vector, executing commands on the operating system by bypassing traditional input validation controls" — Rapid7 MDR team

The "VPN-less" Lateral Movement: Why It Changes the Defense Model

The element that distinguishes this campaign from previous perimeter appliance compromises is the lateral movement technique documented by Rapid7. Instead of establishing traditional VPN tunnels — which would generate session logs and alerts on monitoring systems — the attacker directly used the appliance's LDAP service account to authenticate to internal domain controllers.

Anomalous authentications observed by Rapid7 MDR originated from the appliance's internal IP address, not from active VPN sessions, and used atypical workstation names such as "kali." From the internal network perspective, the LDAP traffic appeared legitimate: it came from authorized infrastructure, with valid credentials, toward standard directory services.

"This unique behavior of direct, machine-level lateral movement with no corresponding active VPN tunnel confirmed that the appliance itself had been fully compromised and was acting as an unmonitored backdoor into the corporate directory infrastructure" — Rapid7 MDR team

This technique invalidates a common structural assumption in network segmentation: that perimeter appliances are "passive" relative to internal traffic and that control over VPN sessions constitutes sufficient visibility. Abuse of the integrated LDAP service account breaks this model: the appliance is no longer just an access terminal, but becomes an active authentication entity with pre-existing privileges in the directory service.

Extended credential theft also includes existing VPN sessions and TOTP seeds, according to Rapid7 analyses and citations from The Hacker News referencing SonicWall and Volexity. This doubles the impact: not only persistent access to the appliance, but also the ability to impersonate legitimate users with their second authentication factors.

Affected Models, Patches, and CISA Deadline

Vulnerable firmware versions are the 12.4.3 series from build 03245 to 03434 and the 12.5.0 series from build 02283 to 02800, on hardware models SMA1000 6210, 7210, and 8200v. According to multiple concurring sources, the patches that fix both vulnerabilities are builds 12.4.3-03453 and 12.5.0-02835, released as platform-hotfixes.

SonicWall has explicitly confirmed that SSL-VPN products on SonicWall firewalls and the SMA100 series are not affected by these vulnerabilities. The distinction is relevant for organizations with mixed portfolios: only the SMA1000 series requires immediate action.

CISA added CVE-2026-15409 and CVE-2026-15410 to the Known Exploited Vulnerabilities catalog on July 14, 2026, with Binding Operational Directive 26-04 requiring remediation by Federal Civilian Executive Branch agencies by July 17, 2026. The CISA catalog also notes association with ransomware campaigns, although no primary source in the dossier documents direct ransomware deployment in observed incidents.

What to Do Now

Priority actions derive directly from recommendations by SonicWall PSIRT, Rapid7, and CISA:

Immediately apply patches 12.4.3-03453 or 12.5.0-02835 on all affected SMA1000 models, with maximum priority for internet-exposed instances.
Perform forensic triage on June-July 2026 logs even on already-patched appliances: look for patterns in extraweb_access.log, anomalies in ctrl-service.log, and unauthorized modifications to /var/lib/unit/conf.json per SonicWall-published IoCs.
Rotate LDAP service credentials configured on the appliance, considering they were exposed in case of compromise, and verify anomalous AD authentications from internal IP addresses of network appliances.
Inspect LDAP traffic from perimeter appliances to domain controllers as if it were traffic from a potential insider threat, not as implicitly trusted infrastructure.

The Limit of Trust in the Perimeter

This case is not just another perimeter compromise: it demonstrates that a compromised perimeter appliance can inherit sufficient structural trust to bypass controls positioned further downstream. The "VPN-less" technique exploits an entropy in the threat model that traditional defenses do not model: that a network infrastructure component can authenticate itself internally without passing through a controlled gateway.

The dossier does not specify the total number of organizations compromised globally nor the geographic distribution of targets. Also remaining to be verified are the relationships between the July CVEs and CVE-2026-83548/83549 that emerged in September 2026 sources, which could indicate a continuation of offensive activity or a partial reclassification. Rapid7 has reported a Metasploit module in development, but availability is not confirmed in the brief.

For organizations with SMA1000, the defensive posture can no longer assume the perimeter appliance is a mere access terminal: it must be treated as a potential authentication actor with directory privileges, with consequent monitoring and isolation.

Information has been verified against cited sources and updated at time of publication.

Sources

Sources and references

Get DeafLetter