AATMAAATMA
Menu
Sign upLog in
Back to News
News

Threat Actor Exploits Zero-Day Vulnerabilities in SonicWall SMA VPN Appliances

A threat actor exploited zero-day vulnerabilities in SonicWall SMA 1000 series VPN appliances, allowing root-level access to compromised devices.

An unknown threat actor, tracked as UTA0533, exploited two zero-day vulnerabilities in SonicWall SMA VPN appliances, enabling arbitrary command execution and root access. The attacks were discovered by Volexity and involved sophisticated tradecraft.

Threat Actor Exploits Zero-Day Vulnerabilities in SonicWall SMA VPN Appliances

A previously undocumented threat actor, tracked as UTA0533, has been attributed to the exploitation of zero-day vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances. The vulnerabilities were exploited prior to their public disclosure on June 22, 2026, according to cybersecurity firm Volexity.

The discovery was made during an incident response investigation earlier this month. The impacted organization has not been identified. Security researchers Sean Koessel and Steven Adair detailed the attack, noting that the threat actor used multiple zero-day exploits and custom malware designed specifically for SonicWall SMA VPN appliances.

Vulnerabilities Exploited

The vulnerabilities in question are:

  • CVE-2026-15409 (CVSS score: 10.0): A pre-authentication bypass allowing unauthenticated external requests to establish a WebSocket tunnel to localhost-only services on the appliance.
  • CVE-2026-15410 (CVSS score: 7.2): A path traversal flaw in the 'remove_hotfix' workflow of the 'ctrl-service,' enabling command execution with elevated privileges.

Patches for both vulnerabilities were released by SonicWall this week.

Attack Details

The threat actor compromised two SonicWall SMA VPN devices belonging to the targeted entity. The attack involved:

  • Writing an ELF executable named /usr/bin/xzfind (ROOTRUN) to execute arbitrary commands as root.
  • Deploying a Python script (KNUCKLEBALL) containing embedded JAR archives, including an HTTP proxy (Suo5) and a custom Java web shell (ORANGETAIL).
  • Modifying startup scripts and NGINX configurations to establish persistence and enable remote interaction.

On the second appliance, the threat actor created files to inspect unencrypted LDAP traffic and extract usernames and passwords. However, a reboot on July 2, 2026, removed memory-resident artifacts and backdoors.

Exploitation Chain

The exploitation chain involved:

  1. Sending an unauthenticated /wsproxy request to establish a WebSocket tunnel.
  2. Accessing CouchDB to read and write files as the couchdb user.
  3. Staging a file in /tmp to read the /sys/class/dmi/id/product_uuid file.
  4. Exploiting CVE-2026-15410 to escalate privileges and obtain root access.

Impact and Mitigation

The threat actor combined multiple zero-day vulnerabilities to compromise the appliances and gain root-level access. This allowed them to access stored or cached credentials, capture network traffic, and potentially intercept credentials processed by the appliances. However, Volexity noted that the attacker was less successful in moving laterally or accessing other systems.

SonicWall has released patches for the vulnerabilities, and organizations are advised to apply them immediately to mitigate the risk of exploitation.