In a recent significant cybersecurity breach, attackers have successfully exploited two zero-day vulnerabilities found within SonicWall Secure Mobile Access (SMA) VPN appliances. These vulnerabilities allowed unauthorized access, leading to the deployment of custom malware.
Details of the Exploitation
Investigations conducted by the cybersecurity firm Volexity in early July 2026 uncovered that the threat actor, identified as UTA0533, strategically utilized these vulnerabilities. By chaining multiple zero-day flaws, the attackers were able to compromise SonicWall devices. This breach resulted in the deployment of custom malware, network traffic interception, and attempts to move laterally within the affected networks.
Evidence points to the exploitation commencing as early as June 22, 2026, with SonicWall later disclosing the vulnerabilities on July 14, 2026. These vulnerabilities impacted SMA 1000 series models, specifically 6210, 7210, and 8200v. SonicWall has since issued hotfixes to address these security gaps.
Technical Insights into the Vulnerabilities
The attackers exploited CVE-2026-15409, which involved a server-side request forgery (SSRF) flaw, enabling them to misuse the /wsproxy endpoint for establishing WebSocket tunnels. Furthermore, they used CVE-2026-15410, a command injection vulnerability, to execute unauthorized code.
This breach facilitated access to internal services such as CouchDB on port 1050 and the SMA control service on port 8188, enabling the attackers to upload files and engage in privileged functions. The path traversal exploit in the execRemoveHotfix function allowed files in /tmp to be executed with root privileges, as indicated by log entries referencing specific paths.
Malware Deployment and Recommendations
Among the compromised devices, the attackers installed a tool named xzfind, with internal references as ROOTRUN, and a Python-based implant called KNUCKLEBALL. These tools facilitated malware injection into SonicWall processes, utilizing Java payloads for persistence.
To counter these threats, organizations are urged to apply SonicWall’s security patches promptly. Additionally, it is crucial to review logs for unusual /wsproxy activity, inspect specific directories for unexpected files, and verify configuration files for unauthorized routes. Volexity has provided YARA rules to assist in detecting the presence of these malicious tools.
As cybersecurity threats evolve, staying informed and proactive in applying security measures is essential to safeguarding network infrastructures.
