SonicWall SMA1000: the CVSS 10 "SSRF" that ends in root (CVE-2026-15409)

An unauthenticated request-forgery bug, chained to CVE-2026-15410, gave attackers root on internet-facing SonicWall appliances — and the credentials and MFA seeds behind them.

July 25, 2026·7 min read

SonicWall SMA1000: the CVSS 10 "SSRF" that ends in root (CVE-2026-15409). An unauthenticated request-forgery bug, chained to CVE-2026-15410, gave attackers root on internet-facing SonicWall appliances

A SonicWall SMA1000 remote-access appliance is supposed to be the guard on your network's front door. CVE-2026-15409 turns it into the intruder: a CVSS 10.0, unauthenticated server-side request forgery in the appliance's Work Place interface that attackers chained to full root and used, as a zero-day, to walk off with credentials and multi-factor secrets weeks before a patch existed.

CVE

CVE-2026-15409A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make...

10.0KEV EPSS 78% CVE

CVE-2026-15410Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could ...

7.2KEV EPSS 76%

Scores as of 23 July 2026live record →

A "read-only" SSRF that ends in root

On paper, CVE-2026-15409 is just a server-side request forgery — the class of bug security teams are trained to treat as an information-disclosure nuisance. The reason it scores a perfect 10 is that it is nothing of the sort. The flaw lives in /wsproxy, the appliance's WebSocket-to-TCP bridge that legitimately brokers remote sessions. Because it fails to validate the destination, an unauthenticated attacker can aim it at localhost and open an attacker-controlled tunnel into services that were never meant to face the internet.

That tunnel is the whole game. It reaches an Erlang service on localhost:1050 that accepts a shared-cookie handshake, yielding code execution as the low-privileged couchdb user. From there, a paired path-traversal bug — CVE-2026-15410 in the appliance's hotfix-removal workflow — runs an attacker script as root. Neither bug is catastrophic alone; together they collapse into unauthenticated, remote, root-level control of the box. Rapid7, which discovered the in-the-wild activity, has published a working proof-of-concept, and a Metasploit module is reportedly in development.

Exploitation chain: /wsproxy SSRF to root and AD compromise

Internet-facing SMA1000 Work Place (443) — Exposed remote-access portal. Prevent: restrict + patch.
Unauthenticated SSRF via /wsproxy — CVE-2026-15409. host=localhost tunnels a WebSocket to internal services.
RCE as couchdb (Erlang localhost:1050) — Shared-cookie handshake -> os:cmd RPC as the couchdb user.
Root via remove_hotfix traversal — CVE-2026-15410. Attacker script runs as root; appliance reboots.
Steal credentials, sessions, MFA seeds — Durable-secret theft. This is why patching alone does not evict the attacker.
VPN-less Active Directory lateral movement — NTLM logons into DCs from the appliance IP, no VPN session.
Deploy custom malware (KNUCKLEBALL / ORANGETAIL / Suo5 / ROOTRUN) — Implants for persistence and tunneling.
Chokepoint: patch + restrict access — No vulnerable, internet-facing /wsproxy = no chain.
Chokepoint: appliance + AD telemetry — On-box logs + the AD-pivot signal detect the intrusion even post-root.

Am I affected?

Only the SMA1000 line is in scope — models 6210, 7210, and the virtual 8200v. The older SMA 100 series is a different product and is not affected by these two CVEs. There is no reliable unauthenticated way to fingerprint the build remotely, so check the firmware version in each appliance's management console against this grid, and confirm against your own mysonicwall.com console before change control.

Branch	Vulnerable builds (reported)	Fixed build
12.4.3	12.4.3-03245 / -03387 / -03434	12.4.3-03453 or later
12.5.0	12.5.0-02283 / -02624 / -02800	12.5.0-02835 or later

How this unfolded

Disclosure timeline

22 Jun 2026First observed exploitation
Earliest intrusion Volexity dates in its incident response — roughly three weeks before any fix existed.
2 Jul 2026Second compromised appliance reboots
Consistent with the root step, which reboots the box.
14 Jul 2026SonicWall advisory + CISA KEV
SNWLID-2026-0008 discloses both CVEs as actively exploited; hotfixes ship; CISA adds both to KEV, due 17 Jul.
15 Jul 2026Rapid7 publishes analysis + PoC
Rapid7 MDR details the chain and releases a Python proof-of-concept for CVE-2026-15409.
17 Jul 2026KEV remediation deadline
Federal civilian deadline; Volexity publishes deep analysis (actor UTA0533, custom malware).

Who's behind it, and what they took

Volexity tracks the operator as UTA0533, a previously unknown cluster whose behaviour reads more like state-aligned espionage than cybercrime — there was no encryption or extortion. (One outlet has linked the activity to the INC ransomware crew; that claim is single-sourced and contradicted by the primary investigators, so treat it as unconfirmed.) The important part for defenders is the objective: after reaching root, the attackers harvested credentials, active session databases, and TOTP MFA seed configurations, then authenticated into internal Active Directory from the appliance itself, without a VPN session. Stolen MFA seeds keep generating valid one-time codes long after the box is patched — which is exactly why patching is only half the job.

Detection: hunt before you trust the patch

If the appliance was internet-exposed during the exploitation window, hunt the on-box and Active Directory signals below. The highest-fidelity signal isn't on the appliance at all — it's a domain controller logon sourced from the appliance's own internal IP with no matching VPN session.

On-appliance IoC hunt (SonicWall / Rapid7 published)

# Illegitimate API routes returning 200 (should never exist)grep -E '"(GET|POST) [^"]*/__api__/(login|logout)[^"]*" 200 ' extraweb_access.log# SSRF tunnel: /wsproxy upgraded to 101 with a host/serviceType parametergrep -E '/wsproxy\?[^ ]*(host=|serviceType=)[^ ]*" 101 ' extraweb_access.log# Root step: remove_hotfix path traversalgrep -E 'remove_hotfix|\.\./\.\./' ctrl-service.log# Config tampering + implantsgrep -E '__api__/(login|logout)' /var/lib/unit/conf.jsonls -la /tmp/deploy_new.py /tmp/temp.db* 2&gt;/dev/null

Deployable detections (proposed — tune to your SMA1000 log format)2 rules

sigma ×1spl ×1

The appliance's log fields are non-standard; validate field mappings and baseline for false positives before alerting.

sigmaSMA1000 Work Place SSRF / illegitimate API access

/wsproxy SSRF tunnels (HTTP 101) and the non-existent /__api__/login|logout routes returning 200 Appliance web/access logs shipped to the SIEM

title: SonicWall SMA1000 Work Place SSRF / illegitimate API access (CVE-2026-15409)
status: experimental
logsource:
  category: webserver
detection:
  wsproxy_tunnel:
    cs-uri-stem|contains: '/wsproxy'
    cs-uri-query|contains: ['serviceType=', 'host=']
    sc-status: 101
  illegit_api:
    cs-uri-stem|contains: ['/__api__/login', '/__api__/logout']
    sc-status: 200
  condition: wsproxy_tunnel or illegit_api
fields: [c-ip, cs-uri-query, sc-status]
level: high

Rapid7 MDR IoCs

splAD pivot from the appliance (highest fidelity)

NTLM network logons into a DC sourced from the SMA1000's internal IP with no correlated VPN session Windows Security 4624 events + a VPN-session lookup

index=wineventlog EventCode=4624 Logon_Type=3 Source_Network_Address=
| search NOT [ inputlookup active_vpn_sessions | fields src_ip ]
| table _time, Account_Name, Workstation_Name, Source_Network_Address, ComputerName

Rapid7 MDR IoCs

Fix it — and evict, don't just patch

Upgrade now (emergency change): every SMA1000 to platform-hotfix 12.4.3-03453 or 12.5.0-02835, or later, from mysonicwall.com. There is no workaround.
Restrict the surface while the change is queued: limit the Work Place portal and management console to trusted admin networks.
Assume compromise if the appliance was internet-facing before you patched — hunt the IoCs above in appliance logs and your AD authentication records.
On any hit, treat it as a full incident: preserve logs and disk images, then re-image the appliance from clean firmware rather than cleaning in place.
Rotate every secret the appliance handled — all user and admin passwords — and re-seed all TOTP/MFA tokens. This is the step teams miss; stolen seeds outlive the patch.

Is CVE-2026-15409 actually exploitable on its own?

The SSRF alone gives an attacker an internal tunnel into the appliance's localhost services. In the observed attacks it was chained with CVE-2026-15410 to reach root, but the SSRF is the unauthenticated entry point that makes the whole chain work — which is why it carries a CVSS of 10.0.

We patched. Are we safe?

Patching closes the vulnerability, but if the appliance was internet-facing before the fix it may already have been compromised. The attackers stole credentials and MFA seeds, so you must also rotate passwords and re-seed all TOTP tokens, then hunt for the compromise indicators.

Which products are affected?

Only SonicWall SMA1000 appliances — models 6210, 7210 and the virtual 8200v. The SMA 100 series is a separate product and is not affected by CVE-2026-15409 or CVE-2026-15410.

Is there a public exploit?

Yes. Rapid7 published a Python proof-of-concept for CVE-2026-15409, ProjectDiscovery ships a safe Nuclei detection template, and a Metasploit module is reportedly in development. Both CVEs are in CISA's KEV catalog with confirmed in-the-wild use.

Scores and details as of 23 July 2026

Sources

SonicWall PSIRT advisory SNWLID-2026-0008 — https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008
Rapid7 MDR: SonicWall SMA1000 zero-days actively exploited — https://www.rapid7.com/blog/post/etr-rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-CVE-2026-15409-CVE-2026-15410/
Volexity: Proxying to compromise SonicWall Secure Mobile Access — https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/
Tenable: CVE-2026-15409 / CVE-2026-15410 analysis — https://www.tenable.com/blog/CVE-2026-15409-CVE-2026-15410-sonicwall-sma-1000-zero-day-vulnerabilities-exploited-in-the
BleepingComputer: SonicWall warns of SMA1000 flaws exploited in zero-day attacks — https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-sma1000-flaws-exploited-in-zero-day-attacks-patch-now/
CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog
NVD: CVE-2026-15409 — https://nvd.nist.gov/vuln/detail/CVE-2026-15409