Cybersecurity company **Volexity** has identified a new, sophisticated threat actor, **UTA0533**, responsible for exploiting zero-day vulnerabilities in **SonicWall Secure Mobile Access (SMA) 1000 series** VPN appliances. These exploits were leveraged prior to their public disclosure, dating back to at least June 22, 2026. ### Unpacking the Zero-Days The attacks involve chaining two critical vulnerabilities: * **CVE-2026-15409** (CVSS score: 10.0): A pre-authentication `/wsproxy` bypass that allows an unauthenticated external request to establish a WebSocket tunnel to localhost-only services. * **CVE-2026-15410** (CVSS score: 7.2): A command injection, privilege escalation, and code execution flaw within the SMA control service. **SonicWall** has since released patches for both vulnerabilities. ### Attack Chain and Persistence **Volexity**'s incident response investigation revealed **UTA0533**'s intricate methods for compromise and persistence across two impacted **SonicWall SMA** VPN devices: **Appliance 1:** * **ELF Executable Drop**: A **setuid** binary named `/usr/bin/xzfind` (dubbed ROOTRUN) was written, enabling arbitrary command execution as root. * **Python Payload**: A Python script, `/usr/lib/python3.11/site-packages/deploy_new.py` (KNUCKLEBALL), containing two embedded JAR archives was injected into a legitimate **SonicWall** process. These payloads included **Suo5**, an open-source HTTP proxy, and **ORANGETAIL**, a custom **Behinder**-like Java web shell. These were accessible via `/workplace/error.jsp` and `/workplace/dialogs/errorDialog.jsp`. * **Persistence**: The legitimate `/etc/init.d/workplace startup` script was modified. * **NGINX Unit Configuration**: The `/var/lib/unit/conf.json` file was altered to add routes for **Suo5** and **ORANGETAIL**. **Appliance 2:** * **NGINX Unit Configuration**: Similar modifications to `/var/lib/unit/conf.json` were observed. * **Data Exfiltration Preparation**: Files were created in `/var/tmp`, including `lib.sh`, designed to launch **tcpdump** to capture unencrypted LDAP traffic for credentials. Despite a reboot on July 2, 2026, which removed some memory-resident artifacts from the second appliance, evidence of the sophisticated attack remained. ### Deeper Dive into Exploitation **Volexity** also uncovered additional files in the `/tmp` folder of the first appliance, including `/tmp/hypdate.b64`, which contained an exploit for **CVE-2026-15410**. These files were owned by an unprivileged internal database service account, indicating the threat actor could write and execute files through this context. Further analysis led to the discovery of **CVE-2026-15409**, a pre-authentication bypass involving a specific `User-Agent` and `bmID` value in a `/wsproxy` request. This allowed unauthenticated external access to localhost-only services, specifically the `sysCtrl` endpoint, enabling command injection and privilege escalation via **CVE-2026-15410**. ### Authentication Bypass Discovered Separately, an authentication bypass for the **SMA** control service (`ctrl-service`) was identified. The basic authentication password is derived from the appliance's local hardware identifier (`/sys/class/dmi/id/product_uuid`). Crucially, this `product_uuid` file is readable by any user, allowing an unprivileged user to obtain the value and determine the password. This particular bypass affects physical devices but not virtual appliances. While this specific authentication bypass was not used in the observed incident, **UTA0533** did exploit **CouchDB**, a database installed on the **SMA** appliance and accessible via localhost, to read the `product_uuid` file and circumvent authentication. **Rapid7**, which also investigated the vulnerabilities, noted: "With this capability, an attacker can reach and exploit less-hardened services running on the appliance, such as the Erlang application on `localhost:1050` or the `ctrl-service` application on `localhost:8188`." ### Full Exploitation Chain **Rapid7** released a proof-of-concept (PoC) exploit, detailing the full chain: 1. Send an unauthenticated `/wsproxy` request with a `User-Agent` string containing `SMA Connect Agent` and a `URI` parameter starting with `bmID=-3389`. 2. Establish a WebSocket tunnel to localhost-only services. 3. Make calls to **CouchDB** to read and write files as the `couchdb` user. 4. Stage a file in `/tmp` as the `couchdb` user to read the `/sys/class/dmi/id/product_uuid` file by exploiting **CVE-2026-15409**. 5. Escalate to root by exploiting **CVE-2026-15410**, a path traversal flaw in the `remove_hotfix` workflow of `ctrl-service`, to gain command execution with elevated privileges. "**UTA0533** combined multiple zero-day vulnerabilities to compromise **SonicWall SMA** VPN appliances and obtain root-level access," **Volexity** concluded. "With root access, the threat actor could access stored or cached credentials, capture network traffic, and potentially intercept credentials processed by the appliances." While the actor demonstrated significant capability in compromising the appliances, evidence suggests less success in lateral movement or gaining access to other systems within the targeted network.