Unknown Threat Actor Chained SonicWall Zero-Days to Root Before Anyone Knew They Existed
A previously unknown threat actor has been quietly exploiting SonicWall Secure Mobile Access 1000 series VPN appliances since at least 22 June 2026, using multiple zero-day vulnerabilities to gain root access before SonicWall had even issued patches. Volexity, which uncovered the activity during an incident response engagement earlier this month, is tracking the group as UTA0533.
Two vulnerabilities are at the centre of this: CVE-2026-15409, rated a perfect 10.0 on the CVSS scale, and CVE-2026-15410, rated 7.2. Chained together, they allow unauthenticated remote code execution and full device takeover. SonicWall shipped patches for both this week.
Volexity found evidence of compromise across two appliances belonging to the unnamed victim organisation. The attack on the first was more thorough.
On 22 June, the attackers dropped a setuid ELF binary called ROOTRUN at '/usr/bin/xzfind', which lets any unprivileged process run commands as root. They also installed a Python script, KNUCKLEBALL, containing two embedded JAR archives that get injected into a legitimate SonicWall process. One JAR is Suo5, an open-source HTTP proxy. The other is a custom Java web shell Volexity calls ORANGETAIL, described as Behinder-like, reachable via '/workplace/error.jsp' and '/workplace/dialogs/errorDialog.jsp'.
From there, persistence was established by modifying the legitimate startup script at '/etc/init.d/workplace', and the NGINX Unit config was altered to route traffic to both Suo5 and ORANGETAIL.
The second appliance had a lighter footprint. The same NGINX config modifications appeared, though the routes were non-functional. More interestingly, files were dropped in '/var/tmp', including a shell script that launches tcpdump specifically to sniff unencrypted LDAP traffic and harvest credentials. A reboot on 2 July wiped whatever was memory-resident, leaving fewer traces.
In the '/tmp' directory of the first appliance, Volexity found files owned by the database service account, one of which contained an exploit for CVE-2026-15410. The ownership is telling: the attackers had write and likely execute access through the database service before escalating further.
The pre-authentication entry point is CVE-2026-15409, a flaw in the '/wsproxy' endpoint. By sending a request with a User-Agent of 'SMA Connect Agent' and a bmID value starting with '-3389', an unauthenticated external attacker can establish a WebSocket tunnel directly to localhost-only services. That access then reaches the 'sysCtrl' endpoint, which opens the door to command injection and privilege escalation via CVE-2026-15410.
There is also a separate authentication bypass worth flagging. The Basic authentication password for the SMA control service is derived from the appliance's hardware UUID, stored at '/sys/class/dmi/id/product_uuid'. That file is world-readable, meaning any unprivileged user can read it and reconstruct the password. On physical appliances at least: virtual ones don't expose the UUID in the same way.
In this particular incident, the attackers didn't use that bypass directly. Instead, they went through CouchDB, a database bundled with the SMA appliance and accessible via localhost, to read the UUID and sidestep authentication.
Rapid7 published a proof-of-concept that chains these issues together, achieving non-root remote code execution by speaking the Erlang protocol to localhost:1050 via the WebSocket tunnel, enabling file reads, writes, and arbitrary code execution through RPC.
The full attack chain runs like this: send the crafted unauthenticated wsproxy request, tunnel to localhost services, abuse CouchDB to read and write files, use CVE-2026-15409 to stage a file that reads the product UUID, then escalate to root by exploiting CVE-2026-15410's path traversal flaw in the 'remove_hotfix' workflow of the control service.
With root in hand, the attacker can access cached credentials, intercept network traffic, and capture anything the appliance processes. Volexity notes, though, that UTA0533 appears to have struggled to move laterally once inside the network, suggesting their capability was concentrated at the appliance layer rather than broader enterprise compromise.
Patches are out. If you're running SMA 1000 series hardware, the update window closed before you started reading this.