Critical SonicWall SMA Vulnerabilities Under Attack
The Appeal of VPN Gateways
Organizations install VPN gateways at the edge of their corporate networks. They do this specifically so remote employees can securely connect to internal systems. Consequently, these devices frequently become a lucrative target for cybercriminals.
On July 14, 2026, SonicWall issued a security advisory regarding two critical vulnerabilities in the SMA 1000 series. These flaws include CVE-2026-15409, which scores 10 on the CVSS 3.1 scale. The second flaw, CVE-2026-15410, carries a score of 7.2.
Early Exploitation by Threat Actors
Although the vendor released patches on July 14, Volexity detected active exploitation of these vulnerabilities much earlier. They observed attacks beginning on June 22, three weeks before the public disclosure. Security researchers link these initial intrusions to a threat group designated as UTA0533. Later, the INC Ransomware group adopted this vulnerability chain. Ultimately, they became the primary exploiters of this scheme.
Bypassing Authentication Mechanisms
The first vulnerability allows attackers to bypass authentication through the /wsproxy endpoint. An adversary simply sends a request with a spoofed ‘SMA Connect Agent’ User-Agent header and a specific parameter. Consequently, the device accepts this request as legitimate internal traffic.
This deception opens a tunnel to restricted services. These services, including the CouchDB database and the ctrl-service component, should only remain accessible from the device itself. Through CouchDB, the attacker gains the ability to read and write files. They execute this action using a low-privileged account, allowing them to host malicious scripts on the compromised device.
Escalating System Privileges
The second vulnerability resides within the update removal function of the ctrl-service. This flaw allows attackers to escape the permitted directory using directory traversal characters. As a result, the system executes a previously staged file with superuser privileges. This escalation grants the attacker absolute control over the entire device.
Deployment of Malicious Payloads
Following this breach, the intruders install a suite of malicious software. They deploy ROOTRUN, a root-privileged backdoor that persists even if defenders remove the other tools. Furthermore, they utilize the KNUCKLEBALL loader. This loader injects malicious code directly into the memory space of a legitimate Java process.
Additionally, the attackers deploy tools for stealthy traffic tunneling and remote command execution. On certain compromised devices, the attackers also intercepted unencrypted LDAP traffic. This action allowed them to harvest valuable employee credentials.
Global Impact and Extortion Tactics
According to a recent assessment by Resecurity, a significant number of vulnerable devices remained unprotected by August 1, 2026. Meanwhile, the INC Ransomware group published data from new victims across Australia, the United States, the UAE, Colombia, and Switzerland.
The security firm also reported a troubling extortion tactic. Several affected organizations received ransom demands via phone calls and emails from individuals claiming to be intermediaries. Interestingly, the domain associated with these communications was registered in early June. This registration occurred well before the official vulnerability notification.
Required Remediation Steps
Administrators must immediately update SMA 1000 devices running affected firmware versions. They should upgrade to versions 12.4.3-03453, 12.5.0-02835, or higher. Furthermore, if a vulnerable device was accessible from the internet prior to patching, organizations must consider it potentially compromised.
Security teams should thoroughly inspect these systems for any signs of a breach. If investigators discover traces of an intrusion, they must reinstall the firmware from scratch. Additionally, they must change all passwords and cryptographic keys processed by the device. Finally, administrators should transition all directory service traffic to encrypted protocols.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
