What This Is
Two zero-day vulnerabilities in SonicWall SMA1000 Series SSL VPN appliances were exploited in targeted attacks before SonicWall was aware of them. Rapid7's Managed Detection and Response team discovered the active exploitation and alerted SonicWall, who published patches on July 14, 2026 and confirmed multiple in-the-wild incidents. CISA added both to the Known Exploited Vulnerabilities catalog the same day with a July 17 deadline. Volexity, brought in to investigate, documented the full attack chain and disclosed that attackers deployed custom malware built specifically for SMA1000 appliances — a level of attacker investment that signals a sophisticated, targeted campaign, not opportunistic scanning.
The SMA1000 sits at the edge of enterprise networks as the VPN gateway for remote access. It is internet-facing by design, it aggregates user credentials, and it has network visibility into internal resources. Compromising the gateway gives an attacker the keys to the remote access infrastructure: credentials, session tokens, and detailed knowledge of the internal network behind it.
Custom malware written for the target appliance means this was not automated scanning. These were deliberate, targeted intrusions against specific organizations. If you run SMA1000 and logs show any anomalous activity in the past 30 days, treat the appliance as compromised — patching alone is not enough.
CVE Details
CVE-2026-15409 — CVSS 10.0 (CRITICAL) — CWE-918 (Server-Side Request Forgery)
An SSRF vulnerability in the SMA1000 Appliance Work Place interface. An unauthenticated remote attacker can send a crafted WebSocket request to the
CVE-2026-15410 — CVSS 7.2 (HIGH) — CWE-94 (Code Injection)
A command injection vulnerability in the SMA1000 Appliance Management Console (AMC). The
CISA KEV: Both added July 14, 2026. Deadline July 17, 2026 (BOD 26-04)
Affected: SonicWall SMA1000 models 6210, 7210, 8200v running versions 12.4.3-03245 through 12.4.3-03434 and 12.5.0-02283 through 12.5.0-02800
Patch: Hotfix releases 12.4.3-03453 and 12.5.0-02835 (released July 14, 2026)
Discovered by: Rapid7 MDR during active incident response
An SSRF vulnerability in the SMA1000 Appliance Work Place interface. An unauthenticated remote attacker can send a crafted WebSocket request to the
/wsproxy path, causing the appliance to open a tunnel to arbitrary services listening only on localhost. This bypasses network-level controls and provides access to internal services that should never be externally reachable.CVE-2026-15410 — CVSS 7.2 (HIGH) — CWE-94 (Code Injection)
A command injection vulnerability in the SMA1000 Appliance Management Console (AMC). The
sysCtrl.execRemoveHotfix RPC method passes a user-supplied value directly to an OS command without sanitization. Exploited through the SSRF tunnel established by CVE-2026-15409, this achieves arbitrary command execution as root.CISA KEV: Both added July 14, 2026. Deadline July 17, 2026 (BOD 26-04)
Affected: SonicWall SMA1000 models 6210, 7210, 8200v running versions 12.4.3-03245 through 12.4.3-03434 and 12.5.0-02283 through 12.5.0-02800
Patch: Hotfix releases 12.4.3-03453 and 12.5.0-02835 (released July 14, 2026)
Discovered by: Rapid7 MDR during active incident response
How the Chain Works
The SMA1000's
/wsproxy WebSocket endpoint is designed to proxy traffic for authenticated remote access sessions. CVE-2026-15409 allows an unauthenticated attacker to abuse this endpoint to establish a WebSocket tunnel to localhost:8188, a management port that is internal-only and should not be accessible from outside the appliance.Once the attacker has a tunnel to port 8188, CVE-2026-15410 becomes reachable. The AMC's RPC interface on that port accepts the
sysCtrl.execRemoveHotfix method, which uses a path traversal technique to pass an attacker-controlled string to an OS shell command. The service executing this runs as root. Result: unauthenticated RCE as root via two HTTP requests — one to establish the SSRF tunnel, one to fire the injection.Volexity's post-exploitation analysis found that after gaining root access, attackers deployed custom malware written specifically for SMA1000 appliances. The malware's functionality and persistence mechanisms were not previously documented, indicating tooling developed for this campaign rather than repurposed commodity tools.
Who Is Exposed
Organizations running SonicWall SMA1000 Series appliances — models 6210, 7210, and 8200v — on any affected firmware version. These appliances are deployed by medium-to-large businesses, government agencies, multinationals, and managed security service providers as their primary SSL VPN gateway. Appliances reachable from the internet on port 443 are directly exploitable. SonicWall notes that SMA 100 Series and SonicWall firewall SSL VPN functionality are not affected — this is specific to the SMA1000 Series.
Detection
Check firmware version immediately:
# Log into the SMA1000 Appliance Management Console
# Dashboard → System Information → Firmware Version
# Must be 12.4.3-03453 or 12.5.0-02835 or later.
# Any earlier version is vulnerable.
# If you cannot access the AMC, check via SSH:
cat /etc/hotfix_version # or equivalent version file
Check for indicators of compromise from SonicWall's advisory:
# SonicWall published IoCs in their security advisory KB article.
# Key indicators to hunt for:
# - Unexpected outbound connections from the SMA1000
# - Unusual processes running as root not part of normal SMA operation
# - New or modified files in appliance directories
# - WebSocket connections to /wsproxy from unauthenticated sources
# - RPC calls to sysCtrl.execRemoveHotfix from unexpected sources
# Review SMA1000 system logs for anomalous activity:
# AMC → Logging → System Log
# Filter for: authentication events, process spawning, file changes
Network-level detection — look for SSRF tunnel activity:
# Unusual WebSocket connections to /wsproxy without prior auth
# In your perimeter firewall or IDS logs:
grep -i "wsproxy" /var/log/firewall.log
# Look for unexpected outbound connections from the SMA1000 IP
# (SMA1000s should not initiate outbound connections to random IPs)
IOCs
Vulnerable path /wsproxy (WebSocket endpoint — SSRF entry point)
Vulnerable RPC sysCtrl.execRemoveHotfix (on localhost:8188 via SSRF tunnel)
Chain CVE-2026-15409 (SSRF tunnel) → CVE-2026-15410 (command injection as root)
Custom malware Specific to SMA1000 — not previously documented (Volexity)
Affected models SMA6210, SMA7210, SMA8200v
Affected firmware 12.4.3 before 03453 | 12.5.0 before 02835
CISA KEV Both CVEs added July 14, 2026. Federal deadline July 17, 2026.
Discovery Rapid7 MDR during active incident — reported to SonicWall before disclosure
Investigation Volexity — full chain documented post-patch
Remediation
Step 1 — Patch immediately: Apply hotfix 12.4.3-03453 (for 12.4.x) or 12.5.0-02835 (for 12.5.x) via the AMC. This is an emergency patch event — do not wait for a maintenance window.
Step 2 — If patching is not immediately possible, restrict access: Firewall the SMA1000 to known user IP ranges only. Restricting internet-facing access eliminates the unauthenticated SSRF vector until the patch is applied.
Step 3 — Patching alone is not sufficient if you were exposed: SonicWall explicitly states this. Review logs for IoCs from their KB article. If indicators are present, SonicWall recommends re-imaging (hardware) or re-deploying (virtual) the appliance, changing all user and administrator passwords, and resetting TOTP tokens.
Step 4 — Rotate VPN credentials: If exploitation is suspected, treat all credentials that flowed through the SMA1000 as potentially harvested. Force password resets on VPN users and revoke active sessions.
Step 5 — Review internal access from the SMA1000's network segment: A compromised VPN gateway has network visibility. Review firewall rules between the SMA1000's segment and internal resources to assess what an attacker could have accessed laterally.
Sources & References
— Rapid7 MDR — Zero-Day Discovery
— BleepingComputer — Custom Malware Analysis (Volexity)
— Tenable — Technical Analysis
— CISA KEV Catalog — CVE-2026-15409, CVE-2026-15410
— NVD — CVE-2026-15409
— MITRE ATT&CK — T1190 Exploit Public-Facing Application
— BleepingComputer — Custom Malware Analysis (Volexity)
— Tenable — Technical Analysis
— CISA KEV Catalog — CVE-2026-15409, CVE-2026-15410
— NVD — CVE-2026-15409
— MITRE ATT&CK — T1190 Exploit Public-Facing Application
More like this, when it happens
Advisories only. No newsletter, no marketing, unsubscribe in one click.
Barr Cyber — Network Hardening & Incident Response
VPN gateways and remote-access appliances are the highest-value targets in most network environments. If your perimeter devices have not been audited, or if you need help determining whether exploitation has occurred, contact Barr Cyber.
Get in Touch →