## SonicWall Zero-Day Exploits Uncovered **SonicWall** recently disclosed that two previously unknown vulnerabilities in its **SMA1000** Secure Mobile Access appliances were under active exploitation in zero-day attacks. These flaws, tracked as **CVE-2026-15409** (a critical server-side request forgery) and **CVE-2026-15410** (a high-severity command injection), affect **SMA1000 6210**, **7210**, and **8200v** appliances. Patches were promptly released in versions **12.4.3-03453** and **12.5.0-02835**, with **SonicWall** urging immediate updates. While the company confirmed the zero-day exploitation, specific details of the attack chain remained undisclosed until now. ## Volexity Details the Attack Chain Incident response firm **Volexity**, which assisted **SonicWall** in the investigation, has published a detailed report outlining the full exploitation chain. According to **Volexity**, a previously unknown threat actor, designated as **UTA0533**, began exploiting these vulnerabilities as early as June 22, weeks prior to public disclosure. **Volexity's** analysis of compromised appliances revealed a sophisticated attack methodology, including the use of multiple zero-day exploits, custom malware specifically designed for **SonicWall SMA** VPN appliances, and other advanced attacker tradecraft. ### Exploitation Stages 1. **CVE-2026-15409 Exploitation**: The attackers first exploited the **CVE-2026-15409** server-side request forgery (SSRF) vulnerability. This allowed them to abuse the **SMA1000**'s `/wsproxy` endpoint, establishing unauthenticated WebSocket tunnels to internal services that should have been restricted to the appliance itself. This exposed internal applications such as **CouchDB** and the VPN device's management service. 2. **Product UUID Acquisition**: Leveraging this initial access, **UTA0533** queried **CouchDB** to obtain the appliance's `product_uuid`. This value was crucial for the subsequent stage of the attack, though the exact method for exploiting **CouchDB** remains unknown. 3. **CVE-2026-15410 Command Injection**: With the `product_uuid` in hand, the attackers then exploited the **CVE-2026-15410** command injection vulnerability. This was achieved through the Appliance Management Console's `sysCtrl.execRemoveHotfix` RPC method, granting them root privileges and full control over the appliance. ## Custom Malware Deployment: KNUCKLEBALL, Sou5, and ORANGETAIL Upon gaining root access, **UTA0533** installed a custom malware dropper, dubbed **KNUCKLEBALL**, under the filename `deploy_new.py`. **KNUCKLEBALL** is responsible for deploying two Java-based malware families specifically tailored for **SonicWall SMA1000** appliances: * **Sou5** (`agent_wp8.jar`): Functions as a reverse proxy, allowing attackers to tunnel traffic through the compromised appliance and maintain covert access to internal network resources. * **ORANGETAIL** (`agent_wp9.jar`): A custom Java webshell that enables attackers to send encrypted Java payloads to the compromised appliance and dynamically execute them within an HTTP session.  **Volexity** researchers also observed that the attackers modified the appliance's **nginx** configuration to remotely expose the **ORANGETAIL** webshell. Additionally, a privilege-escalation tool named **ROOTRUN** was installed to facilitate the execution of commands as root. While the campaign and its associated malware demonstrate significant technical sophistication, **Volexity** noted that the threat actor had limited success in spreading deeper into victims' internal networks beyond the compromised **SMA1000** appliances themselves. This incident underscores the critical importance of timely patching and robust incident response capabilities when dealing with sophisticated, zero-day threats targeting network infrastructure.