SonicWall SMA zero-days were exploited weeks before disclosure

Two recently disclosed SonicWall SMA 1000 vulnerabilities – CVE-2026-15409 and CVE-2026-15410 – were exploited in zero-day attacks for weeks, allowing threat actors to install custom malware on vulnerable VPN appliances, Volexity researchers revealed.

The intrusions began as early as June 22, 2026, well before the flaws became public. According to the researchers, the attackers’ goal was stealthy, long-term access: once inside, the intruders could reach stored or cached credentials, capture network traffic, and potentially intercept credentials processed by the appliances.

Despite their ability to leverage zero-day exploits and compromise the devices, “available evidence suggests the threat actor was less successful moving laterally or gaining access to other systems,” they added.

How the attack unfolded

Volexity was able to analyze logs, disk images, and the memory of two compromised appliances, which generally serve as secure remote-access gateways for medium-to-large businesses, multinationals, government agencies, and managed security providers.

The attack chain (Source: Volexity)

They found that the group first abused CVE-2026-15409 (a SSRF flaw) to open a tunnel from the open internet to internal-only services. This exposed three localhost services, including a bundled CouchDB database and an internal control service.

The bundled CouchDB ships with hardcoded admin:admin credentials and is normally localhost-only, but the SSRF tunnel put it within reach. The attackers used it to write and run a script that read the hardware ID file, which allowed them to “access methods in the sysCtrl endpoint, which were vulnerable to command injection, privilege escalation, and code execution.”

From there they exploited the second bug: CVE-2026-15410, a code-injection flaw that lets attackers run arbitrary operating-system commands. They did it via a booby-trapped file path that let them execute their own script with the highest level of privilege on the device.

Once they had root, the attackers installed a privilege-escalation tool (ROOTRUN, file name: xzfind) and a Python-based loader (KNUCKLEBALL, file name: deploy_new.py). The latter injected two hidden Java components directly into a legitimate running SonicWall process, to keep the malware in memory.

One component was an open-source proxy tool (Suo5, file name: agent_wp8.jar) for relaying traffic; the other was a custom web shell Volexity calls ORANGETAIL (file name: agent_wp9.jar), which only responded to requests carrying a specific, slightly-off browser identification string, and executes Java payloads sent by the attackers.

Finally, the attackers rewrote the appliance’s web configuration so that innocuous-looking web addresses secretly routed to Suo5 and ORANGETAIL, and attempted to pivot further into the target organizations’ network by capturing and using authentication credentials.

What should defenders do?

Patching is necessary but not enough.

SonicWall advises organizations that find indicators of compromise to re-image or re-deploy the affected appliances, change all user and administrator passwords, and reset TOTP tokens. The company stressed that even after applying the update, customers should review logs for indicators of compromise.

Volexity researchers shared indicators of compromise and YARA signatures to help organizations detect the malware families used by the attackers, and advised them to look for:

• Unexpected connections from SonicWall SMA appliances
• Unexpected files in /var/tmp and /tmp
• Unexpected routes in the nginx configuration file (/var/lib/unit/conf.json)
• Unexpected setuid binaries

Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!