Two recently disclosed SonicWall SMA1000 vulnerabilities were exploited in zero-day attacks for weeks, allowing threat actors to install custom malware on vulnerable VPN appliances.
Last week, SonicWall warned that threat actors were actively exploiting two previously undisclosed vulnerabilities in an exploit chain that affected SMA1000 Secure Mobile Access appliances.
The flaws, tracked as CVE-2026-15409, a critical server-side request forgery (SSRF) vulnerability, and CVE-2026-15410, a high-severity command injection flaw, affect SMA1000 6210, 7210, and 8200v appliances.
SonicWall released patches in versions 12.4.3-03453 and 12.5.0-02835, urging customers to install the updates immediately.
While SonicWall confirmed that the flaws were exploited as zero-days, they did not disclose details on how the attackers were compromising the devices.
In a new report, incident response firm Volexity, which assisted SonicWall in investigating the attacks, detailed the full exploitation chain and how threat actors installed the custom malware on compromised SMA1000 appliances.
According to Volexity, a previously unknown threat actor it tracks as UTA0533 began exploiting the vulnerabilities as early as June 22, weeks before SonicWall publicly disclosed the flaws.
“Volexity’s analysis of logs, disk images, and memory led to the discovery of a threat actor Volexity tracks as UTA0533,” explains the Volexity report.
“This threat actor was observed using multiple zero-day exploits, malware designed specifically for SonicWall SMA VPN appliances, as well as other attacker tradecraft. Volexity notes that June 22, 2026, was the earliest sign of compromise observed in the investigation.”
In an investigation of two compromised appliances, Volexity found that the attackers first exploited CVE-2026-15409 to abuse the SMA1000’s ‘/wsproxy’ endpoint, allowing them to establish unauthenticated WebSocket tunnels to services that should only have been accessible from the appliance itself.
This exposed internal applications, including CouchDB and the VPN device’s management service.
Using this access, the attackers queried CouchDB to obtain the appliance’s ‘product_uuid’, a value required to complete the second stage of the attack. Volexity says the exact method used to exploit CouchDB remains unknown.
After obtaining the appliance’s product_uuid, the attackers exploited the CVE-2026-15410 command injection vulnerability through the Appliance Management Console’s ‘sysCtrl.execRemoveHotfix’ RPC method, allowing them to execute commands as root and take full control of the appliance.
With root access, UTA0533 installed a custom malware dropper that Volexity calls KNUCKLEBALL under the file name ‘deploy_new.py’.
KNUCKLEBALL is used to deploy two Java-based malware families named Sou5 (agent_wp8.jar) and ORANGETAIL (agent_wp9.jar), designed for SonicWall SMA1000 appliances.
According to Volexity, Sou5 functions as a reverse proxy, allowing attackers to tunnel traffic through the compromised appliance and maintain covert access to internal resources.
ORANGETAIL is a custom Java webshell that allows attackers to send encrypted Java payloads to the compromised appliance and dynamically execute them within an HTTP session.
The researchers also found that the attackers modified the appliance’s nginx configuration to expose the ORANGETAIL webshell remotely and installed ROOTRUN, a privilege-escalation tool that allows commands to be executed as root.
Volexity says that while the campaign and malware showed “significant” technical sophistication, the threat actor was less successful at spreading into victims’ internal networks.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now
Google fixes one actively exploited Android zero-day, 124 flaws
Progress confirms ShareFile zero-day flaw behind Storage Zone shutdown
We built a vulnerability vending machine: AI tokens in, zero-days out
CISA warns of actively exploited RCE flaws in Joomla extensions
Update now: 7-Zip fixes RCE flaw exploitable with malicious archives
WordPress Core “wp2shell” RCE flaws get public exploits, patch now
Microsoft warns of surge in ACR Stealer attacks on customers
See how Pixellot discovered and secured hundreds of unmanaged AI agent identities in weeks, not months. Read the case study.
Pentest your web apps on-demand. Find what humans miss. Scope and launch a pentest in minutes.
Calculate what you’d save by replacing your MDR.
AI broke vulnerability management. Get the guide CISOs use to shift budget to BAS.
Privacy by policy or privacy by architecture? See how age checks work when the face never leaves the device.
Do you have what it takes to challenge DARKROOM? Signup for an exclusive DEFCON CTF!
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
