"This threat actor was observed using multiple zero-day exploits, malware designed specifically for SonicWall SMA VPN appliances, as well as other attacker tradecraft," security researchers Sean Koessel and Steven Adair wrote in their analysis.
Who Volexity is tracking: UTA0533 and two compromised appliances
Cybersecurity company Volexity attributes a previously undocumented threat actor, tracked under the moniker UTA0533, with exploiting SonicWall Secure Mobile Access (SMA) 1000 series appliances as zero-days prior to public disclosure on June 22, 2026. Volexity discovered the activity during an incident response earlier in July; the impacted organization has not been identified. The investigators found two distinct SMA devices belonging to the compromised environment and reconstructed a multi-stage intrusion on each.
Artifact and persistence details on Appliance 1
On June 22, 2026, the attacker wrote an ELF executable at /usr/bin/xzfind on Appliance 1. That file was a setuid binary called ROOTRUN, permitting an unprivileged user to run arbitrary commands as root. The adversary also placed a Python payload at /usr/lib/python3.11/site-packages/deploy_new.py — dubbed KNUCKLEBALL — which contained two embedded JAR archives. Those JARs injected into a legitimate SonicWall process delivered Suo5, an open-source HTTP proxy, and a custom Java web shell the researchers call ORANGETAIL. ORANGETAIL exposed internet-accessible URIs at /workplace/error.jsp and /workplace/dialogs/errorDialog.jsp.
To establish persistence, the attackers modified the appliance's startup script (/etc/init.d/workplace startup) using the downloaded Python script. They also altered the NGINX Unit configuration at /var/lib/unit/conf.json to add routes directing traffic to Suo5 and ORANGETAIL.
Artifacts on Appliance 2 and ephemeral cleanup
Appliance 2 showed similar modifications to /var/lib/unit/conf.json, although the added routes did not return valid responses. The attacker also dropped multiple files in /var/tmp, including lib.sh, which launched tcpdump to capture unencrypted LDAP traffic — a tactic used to extract usernames and passwords. A reboot on July 2, 2026, removed many memory-resident artifacts and backdoors from the second device, leaving fewer persistent traces.
The exploited flaws: CVE-2026-15409, CVE-2026-15410, and related weaknesses
Volexity identified two vulnerabilities chained by the actor: CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410 (CVSS 7.2). According to the researchers, CVE-2026-15409 is a pre-authentication "/wsproxy" bypass that allows an unauthenticated external request to establish a WebSocket tunnel to localhost-only services. The bypass is triggered by sending a request with a User-Agent of "SMA Connect Agent" and a bmID value beginning with -3389. That external access can be used to reach methods in the appliance's sysCtrl endpoint and to exploit command injection, privilege escalation, and code execution flaws in the SMA control service, enabling CVE-2026-15410 to be abused for root-level takeover.
Volexity also flagged an authentication weakness in the SMA control service (ctrl-service): the Basic-auth password is derived from the appliance-local hardware identifier (/sys/class/dmi/id/product_uuid). Because that product_uuid file is world-readable on physical devices, an unprivileged user can obtain the UUID and determine the control-service password. Volexity noted that this particular authentication bypass "does not appear to have been used in the observed incident." Instead, the actor used another route — interacting with the CouchDB instance bundled on the appliance — to read the product_uuid file.
Exploitation chain reconstructed by Volexity
- Send an unauthenticated /wsproxy request with User-Agent containing SMA Connect Agent and a URI parameter starting with bmID=-3389.
- Establish a WebSocket tunnel to localhost-only services.
- Make calls to CouchDB to read and write files as the couchdb user.
- Stage a file in /tmp as the couchdb user that reads /sys/class/dmi/id/product_uuid once executed via CVE-2026-15409.
- Escalate to root by exploiting CVE-2026-15410, a path traversal flaw in the remove_hotfix workflow of ctrl-service, yielding command execution with elevated privileges.
What this means for technologists, affected enterprises, and procurement leaders
Technologists and security teams: Volexity's analysis shows an attacker chain that moves from unauthenticated WebSocket proxying to local service abuse, CouchDB file operations, and final privilege escalation to root. Teams managing SMA 1000 appliances should prioritize the patches SonicWall released this week and search appliances for indicators described by Volexity (setuid ROOTRUN binaries, KNUCKLEBALL deploy_new.py, modified NGINX Unit routes, and temporary /tmp artifacts such as hypdate.b64).
Affected enterprises and procurement leaders: Two devices in a single environment were sufficient for UTA0533 to stage proxies, web shells, and credential-capturing tooling. Volexity warned that with root access, an attacker could "access stored or cached credentials, capture network traffic, and potentially intercept credentials processed by the appliances." Procurement and operations teams should consider that physical and virtual appliances differ here: the world-readable product_uuid was observed only on physical devices.
Volexity summarized the campaign succinctly: "UTA0533 combined multiple zero-day vulnerabilities to compromise SonicWall SMA VPN appliances and obtain root-level access." The firm also noted available evidence suggests the actor was less successful at lateral movement beyond the appliances themselves. Patches for CVE-2026-15409 and CVE-2026-15410 were released by SonicWall this week; operators should apply them and validate that injected files and modified startup and NGINX Unit configurations have been remedied.
Original reporting: https://thehackernews.com/2026/07/sonicwall-sma-zero-days-exploited.html
