SonicWall SMA 1000 Zero-Days Exploited in Wild

Originally published on CyberNetSec.

Executive Summary

Two critical zero-day vulnerabilities in SonicWall's Secure Mobile Access (SMA) 1000 series appliances were actively exploited in the wild for at least three weeks before patches were released. Security firm Volexity reports that attackers began exploiting the flaws on June 22, 2026, chaining them together to achieve unauthenticated remote code execution (RCE) on vulnerable VPN gateways. The two vulnerabilities are CVE-2026-15409, a Server-Side Request Forgery (SSRF) flaw, and CVE-2026-15410, a code injection flaw. The attackers demonstrated a high level of sophistication, deploying custom, memory-resident malware for long-term, stealthy access aimed at capturing credentials. Due to active exploitation, CISA has added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog, requiring immediate remediation.

---

Vulnerability Details

The attack involves a two-stage exploit chain targeting the SonicWall SMA 1000 series appliances.

1. CVE-2026-15409 (CVSS 10.0 - Critical): This is a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker can exploit this flaw to force the appliance to make web requests to arbitrary destinations, including internal-only services running on the device itself. The attackers used this to access a bundled CouchDB database service that was listening on the local interface.

2. CVE-2026-15410 (CVSS 7.2 - High): This is a code injection vulnerability. After gaining access to the internal CouchDB service using the SSRF, the attackers found it was configured with default credentials (admin:admin). They then abused a feature in the database to inject and execute arbitrary OS commands on the appliance with root privileges.

This chain allows a remote, unauthenticated attacker to gain full control over a critical perimeter security device, representing a worst-case scenario for a network defender.

Affected Systems

The vulnerabilities affect the following SonicWall products:

• SMA 1000 Series Appliances running versions prior to the patched releases.

Organizations using these appliances for remote access are directly at risk. SonicWall has released patches, and administrators are urged to apply them immediately.

Exploitation Status

These vulnerabilities were exploited as zero-days, with attacks observed in the wild starting around June 22, 2026, well before the public disclosure on July 14, 2026. The threat actors' primary goal was not immediate destructive action but long-term, stealthy persistence.

Upon gaining root access, the attackers deployed a sophisticated malware toolkit:

• ROOTRUN: A privilege-escalation tool.
• KNUCKLEBALL: A Python-based loader that injects malicious components directly into a legitimate, running SonicWall process. This technique makes the malware memory-resident, helping it evade file-based detection.

The objective was to capture credentials of users connecting to the VPN and monitor network traffic, indicating an intelligence-gathering or espionage motive.

Impact Assessment

A successful exploit gives an attacker complete control over a network's VPN gateway. This enables them to:

• Decrypt VPN Traffic: Intercept and decrypt all traffic passing through the appliance.
• Steal Credentials: Capture usernames, passwords, and session cookies for all connecting users.
• Pivot into the Network: Use the compromised appliance as a beachhead to launch further attacks against the internal network.
• Man-in-the-Middle Attacks: Modify traffic passing through the VPN.

The compromise of a perimeter device like the SMA 1000 effectively renders all other network defenses moot, as the attacker is already 'inside' the trusted boundary.

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable or compromised systems:

Type	Value	Description
URL Pattern	/cgi-bin/	Monitor web logs for unusual requests to CGI endpoints on the SMA appliance, which may indicate SSRF attempts.
Log Source	SonicWall SMA logs	Look for logs indicating access to the internal CouchDB service from the appliance's external interface.
Process Name	python	Unexpected execution of Python scripts or interpreters on the appliance.
Network Traffic Pattern	Outbound connections from the SMA appliance to unknown IPs	A compromised appliance may be used to exfiltrate data or connect to a C2 server.

Detection Methods

(D3FEND: Network Traffic Analysis, Process Analysis)

1. Log Analysis: Scrutinize logs from SonicWall SMA appliances for any evidence of the SSRF attack. Look for access attempts to internal services originating from the appliance's public IP address. Check for any log entries related to CouchDB access or errors.
2. Memory Analysis: For potentially compromised devices, perform a memory dump and analyze it for signs of the KNUCKLEBALL loader or other injected code within legitimate processes. This is crucial as the malware is memory-resident.
3. Network Flow Analysis: Analyze NetFlow data to identify any unusual connections originating from the SMA appliance's management interface to external systems. The attackers' C2 infrastructure would likely appear as anomalous traffic.
4. Vulnerability Scanning: Use a vulnerability scanner with updated plugins to identify unpatched SonicWall SMA 1000 devices on your network.

Remediation Steps

(D3FEND: Software Update, Credential Eviction)

1. Patch Immediately: Applying the security updates released by SonicWall is the most critical step. Given active exploitation, this should be treated as an emergency change. (M1051 - Update Software)
2. Assume Compromise: If you were running a vulnerable version, you must assume the device was compromised. The attackers had a three-week window of opportunity.
3. Reset and Reconfigure: The safest course of action is to wipe the appliance, perform a factory reset, and reconfigure it from scratch after installing the patched firmware. Do not restore from a backup made while the device was vulnerable.
4. Rotate All Credentials: Immediately reset all credentials that were used to connect to or manage the VPN appliance. This includes all user passwords, service accounts, and administrative accounts. Assume all have been stolen. (M1027 - Password Policies)