Sonic Wall SMA Zero-Days Exploited Before Disclosure to Gain Root Access
Summary: Volexity attributed exploitation of SonicWall SMA 1000 VPN appliances to a threat actor it calls UTA0533, which used zero-days CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410 (CVSS 7.2) before public disclosure, starting June 22, 2026, against two devices belonging to an unidentified organization. The chain used a pre-authentication /wsproxy bypass to open a WebSocket tunnel to localhost services, then reached CouchDB to read the product_uuid file and bypass ctrl-service authentication, yielding root access; SonicWall released patches this week.
Why it matters: Root on a VPN appliance means stored or cached credentials and traffic passing through it are exposed, and Rapid7 says INC Ransomware has emerged as the dominant actor weaponizing this chain - so unpatched SMA 1000 devices are a live entry point, not a theoretical one.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2026-15409CVE-2026-15410
- Related