Zero-day vulnerability chain enables root access and malware deployment on SonicWall SMA1000 appliances

Summary

A sophisticated threat actor, tracked as UTA0533, has been targeting SonicWall SMA1000 Secure Mobile Access appliances using a multi-stage zero-day exploit chain. The campaign was active as early as June 22, 2026, weeks before the vulnerabilities were publicly disclosed.

The attack chain begins with a server-side request forgery (SSRF) to probe internal services and concludes with a command injection vulnerability that grants full root control over the appliance. Once access is established, attackers deploy specialized malware designed specifically for these VPN devices to maintain persistence and tunnel traffic through the compromised hardware.

Technical details

The exploitation workflow relies on two distinct vulnerabilities to move from unauthenticated access to full system takeover.

The first stage involves CVE-2026-15409, a critical SSRF vulnerability. Attackers abuse the /wsproxy endpoint to establish unauthenticated WebSocket tunnels to services that should remain isolated from external access. This allows them to interact with internal applications such as CouchDB and the appliance's management service. By querying CouchDB, attackers retrieve the product_uuid, a specific value required for the second stage of the attack.

The second stage utilizes CVE-2026-15410, a high-severity command injection flaw. Using the product_uuid obtained previously, attackers target the Appliance Management Console's sysCtrl.execRemoveHotfix RPC method. This execution allows them to run commands with root privileges, providing complete control over the device.

Once root access is achieved, the actor depls a malware dropper named deploy_new.py (referred to as KNUCKLEBALL). This dropper installs two Java-based malware families:

• Sou5 (agent_wp8.jar): Functions as a reverse proxy to tunnel traffic through the appliance for covert access to internal resources.
• ORANGETAIL (agent_wp9.jar): A custom Java webshell that receives encrypted payloads and executes them within an HTTP session.

The attackers also modified the nginx configuration to expose the ORANGETAIL webshell remotely and installed a tool called ROOTRUN for privilege escalation.

Affected products and fixed versions

The vulnerabilities impact specific models within the SonicWall SMA1000 series.

Detection opportunities

Defenders can identify potential compromise by monitoring appliance logs for specific patterns associated with the /wsproky endpoint and WebSocket upgrades.

Check /var/log/aventail/extraweb_access.log for GET requests targeting /wsproxy where the host is set to 0.0.0.0 or internal IP addresses, particularly those attempting to access ports 1050 (CouchDB) or 8188 (Control Service). Successful protocol upgrades are indicated by a status code of 101.

Additionally, monitor for unusual POST requests to arbitrary endpoints such as /__api__/login or /__api__/logout, which the attackers used to interact with their installed webshells.

Why this matters for defenders

This attack demonstrates how specialized malware can be tailored for specific network appliances to facilitate lateral movement and persistence. While Volexity noted that the threat actor was less successful at spreading into internal networks, the ability to establish a reverse proxy via Sou5 provides a direct tunnel into the heart of a protected environment.

Defender guidance

Immediate action is required for all administrators running affected SMA1000 models.

1. Apply Patches: Update firmware to version 12.4.3-03453 or 12.5.0-02835 immediately.
2. Audit Logs: Review extraweb_access.log and access_servers.log for the suspicious /wsproxy patterns described above.
3. Verify Integrity: Inspect the appliance for unauthorized files, specifically looking for deploy_new.py, agent_wp8.jar, agent_wp9.jar, or any unexpected modifications to the nginx configuration.
4. Monitor Traffic: Watch for unusual outbound connections from the SMA appliance that may indicate a reverse proxy connection being established via Sou5.