Vulnerability Analysis

CVE-2026-15409 & CVE-2026-15410: SonicWall SMA1000 Zero-Days Chained for Unauthenticated Root RCE

Executive Summary

Two actively exploited zero-day vulnerabilities in SonicWall's SMA1000 Series remote access appliances allow an unauthenticated attacker to achieve full root-level code execution by chaining a WebSocket-based SSRF (CVE-2026-15409, CVSS 10.0) with a path-traversal code injection flaw (CVE-2026-15410, CVSS 7.2). Discovered by Rapid7's MDR team before SonicWall published its advisory on July 14, 2026, both CVEs are confirmed under active exploitation in the wild and are listed on CISA's Known Exploited Vulnerabilities (KEV) catalog. Organizations running affected appliances should treat this as an emergency and apply hotfix patches immediately.

1. What Is This Vulnerability?

SonicWall SMA1000 Series appliances are enterprise remote-access gateways that provide SSL VPN, zero-trust network access, and web-based application proxying for large organizations. These appliances sit on the internet-facing perimeter — making them high-value targets for threat actors seeking initial access to corporate networks.

CVE-2026-15409 — Unauthenticated SSRF via WebSocket Proxy (CVSS 10.0)

The primary vulnerability resides in the /wsproxy endpoint of the SonicWall WorkPlace web application (served on port 443 by default). This feature is designed to facilitate WebSocket-based TCP tunneling to internal services, but it fails to validate or restrict the host and port parameters provided by the client.

An unauthenticated attacker can craft a WebSocket request pointing host to localhost (or ::ffff:127.0.0.1) and port to any internal service on the appliance. This creates a bidirectional tunnel — effectively a netcat-like connection — through which the attacker can interact with unexposed internal services such as the Erlang EPMD service on localhost:1050 or the ctrl-service application on localhost:8188.

Example exploit request (from Rapid7's PoC):

python3 cve-2026-15409.py \
  --ws-url 'wss://TARGET/wsproxy?bmID=-3389c1b25ccd&serviceType=SSH&host=0.0.0.0&port=1050' \
  --ws-user-agent 'SMA Connect Agent' \
  --ws-insecure-tls \
  --cookie 10ecad5b446e86864832904cd439b6b70262 \
  --exec 'whoami && id && hostname'

The Erlang process accepts a hardcoded cookie value (10ecad5b446e86864832904cd439b6b70262), meaning no credentials are required to authenticate to it once tunneled through. This yields remote code execution as the couchdb user.

CVE-2026-15410 — Authenticated Path Traversal Code Injection (CVSS 7.2)

The second vulnerability exists in the remove_hotfix workflow within the ctrl-service application (localhost:8188). The hotfix name parameter is not sanitized, allowing a path traversal sequence to point to an attacker-controlled script. The system then chmods and executes the script as root, followed by a system reboot.

Malicious HTTP request exploiting CVE-2026-15410:

POST /rollbackConfirm.action HTTP/1.1
Host: TARGET:8443
Content-Type: application/x-www-form-urlencoded

csrfToken=GFEJUCQBUZOLUCCOO3YBA8G30ZE9VKDP&command=rollback&hotfix=../../../../../tmp/evil.sh

System-level execution (observed via pspy):

UID=0  | chmod +x /var/lib/aventail/avp/rollback/../../../../../tmp/evil.sh
UID=0  | /bin/bash /var/lib/aventail/avp/rollback/../../../../../tmp/evil.sh --unattended
UID=0  | shutdown -r now

Attack Vector

The full exploit chain requires no prior authentication:

  1. Stage 1 (CVE-2026-15409): Attacker sends an unauthenticated WebSocket request to /wsproxy with host=localhost&port=1050, establishing a tunnel to the Erlang EPMD process.
  2. Stage 2 (RCE as couchdb): Using the hardcoded Erlang cookie, the attacker authenticates to the Erlang process and executes OS commands as the couchdb user.
  3. Stage 3 (CVE-2026-15410 — root escalation): The attacker drops a shell script to /tmp/ via the couchdb user context, then triggers the remove_hotfix workflow pointing to the script via path traversal. The system executes it as root.

Real-World Impact

Rapid7's MDR team observed threat actors using this chain in the wild before disclosure. Post-compromise activity included:

  • Extraction of credential databases and active session tokens from the appliance filesystem (e.g., /tmp/temp.db*)
  • Theft of TOTP/MFA seed configurations — enabling attackers to bypass MFA even after password resets
  • Lateral movement via the appliance's internal LDAP service account, making anomalous NTLM logons directly into Active Directory domain controllers
  • Use of non-inventory hostnames (kali, DESKTOP-KRLUI3J) originating from the appliance's internal IP, indicating the device was repurposed as a covert pivot point

2. Who Is Affected?

Affected Products: SonicWall SMA1000 Series — Models 6210, 7210, and 8200v

Vulnerable Firmware Builds:

Branch Vulnerable Builds
12.4.3 03245, 03387, 03434 (platform-hotfix)
12.5.0 02283, 02624, 02800 (platform-hotfix)

Not affected:

  • SonicWall SMA 100 Series product line
  • SSL VPN functionality on SonicWall firewalls (e.g., NSA, TZ series)

Any organization with a SMA1000 appliance accessible from the internet running the above builds should treat this as actively compromised until proven otherwise, given the confirmed exploitation timeline beginning prior to July 14, 2026.

3. How to Detect It (Testing)

Manual Testing Steps

Step 1 — Identify exposed appliances

Check if the SMA1000 WorkPlace portal (/wsproxy path) is internet-accessible:

curl -k -I https://TARGET/wsproxy
# A 400 or 101 response (vs. 404) indicates the endpoint exists

Step 2 — Check firmware version

Log into the SMA1000 Appliance Management Console (AMC) and navigate to System > Firmware. Verify the build number against the vulnerable list above.

Step 3 — Look for SSRF exploitation indicators in access logs

Review extraweb_access.log for:

GET /wsproxy ... =-3389 ... 101

If host=localhost or host=::ffff:127.0.0.1 appears alongside HTTP 101 responses, exploitation is highly probable.

Step 4 — Check for hotfix path traversal in ctrl-service logs

Review ctrl-service.log for invocations of /usr/local/bin/remove_hotfix containing .. traversal sequences pointing to /tmp/ paths.

Step 5 — Check for session/credential database access

Look for access to paths like /tmp/temp.db* or unusual queries to the session database in appliance logs.

Automated Scanning

Tool: Tenable / Nessus

  • Tenable released authenticated checks for CVE-2026-15409 and CVE-2026-15410 in its July 15, 2026 content release.
  • Run a credentialed scan against SMA1000 appliances with the latest plugin feed.

Tool: Rapid7 InsightVM / Nexpose

  • Vulnerability checks for both CVEs available in the July 15 content release.
  • Configure authenticated scanning for SMA1000 hosts.

Tool: Shodan (exposure discovery)

shodan search "SonicWall SMA1000" port:443

Use this to identify internet-facing instances in your ASN or IP ranges.

Tool: nuclei

A community template targeting the /wsproxy fingerprint can be run as:

nuclei -u https://TARGET -t cve/2026/CVE-2026-15409.yaml

(Check nuclei-templates GitHub for the latest community-contributed template.)

Code Review Checklist

For organizations building integrations or custom tooling on top of SMA1000:

  • Confirm WebSocket proxy endpoints validate and whitelist host and port parameters
  • Verify no internal service accepts unauthenticated connections over hardcoded credentials/cookies
  • Confirm hotfix and rollback workflows sanitize file path inputs against traversal sequences
  • Review any user-controlled parameters that are passed to filesystem or shell operations

4. How to Fix It (Mitigation)

Step-by-Step Remediation

Step 1 — Apply the emergency platform hotfix immediately

Download and apply the fixed build via your MySonicWall account:

Branch Fixed Build (minimum)
12.4.3 12.4.3-03453 (platform-hotfix)
12.5.0 12.5.0-02835 (platform-hotfix)

SonicWall has confirmed no workaround exists for these vulnerabilities. Patching is mandatory.

Step 2 — Conduct forensic review before patching

If compromise is suspected, perform log review for the IOCs listed in the Detection section before patching to preserve forensic state.

Step 3 — Re-image if compromise is confirmed

SonicWall recommends:

  • Physical appliances: Full re-imaging via the recovery partition
  • Virtual appliances (8200v): Redeploy from a clean snapshot or OVA

Step 4 — Rotate all credentials and MFA tokens

Because threat actors were observed stealing TOTP seed material from the appliance:

- Reset all VPN user passwords
- Reset all SMA1000 administrator passwords
- Revoke and re-enroll all TOTP/MFA tokens linked to the appliance
- Rotate the LDAP/AD service account password used by the appliance

Step 5 — Audit Active Directory for lateral movement

Review Windows Security Event Log (Event ID 4624, Logon Type 3) for NTLM logons originating from the appliance's internal IP. Treat any such logins as potentially attacker-controlled.

Step 6 — Block known attacker IP ranges (interim)

While patching, consider blocking access from ASN 206092 (F.N.S Holdings Limited) which Rapid7 identified as the infrastructure used by threat actors:

45.131.194.0/24
45.146.54.0/24
63.135.161.0/24
173.239.211.0/24

Configuration Hardening

After patching, apply the following hardening measures:

  • Restrict management interface access: Limit AMC access to trusted admin source IPs via firewall rules; do not expose port 8443 to the internet.
  • Disable unused services: Review and disable WorkPlace features not actively used by the organization.
  • Enable logging to SIEM: Forward extraweb_access.log and ctrl-service.log to a centralized SIEM for continuous monitoring.
  • Deploy WAF/reverse proxy in front of appliance: Where possible, place a Web Application Firewall in front of the WorkPlace portal to filter anomalous WebSocket requests.

5. How to Test the Fix (Validation)

Regression Test Scenarios

  • Scenario A: Confirm the patched build is running — log into AMC, navigate to System > Firmware, verify build number is 12.4.3-03453 or 12.5.0-02835 or higher.
  • Scenario B: Confirm /wsproxy endpoint no longer accepts host=localhost tunneling requests — send a crafted WebSocket request and verify it is blocked with a non-101 response.
  • Scenario C: Confirm remove_hotfix workflow rejects path traversal inputs — submit a hotfix value containing ../ and verify the request is rejected with an error rather than executed.
  • Scenario D: Confirm legitimate WorkPlace VPN functionality still operates correctly for end users after applying the patch.

Security Test Cases

Test Case 1: SSRF endpoint blocked

  • Precondition: Apply platform hotfix
  • Steps: Send GET /wsproxy?bmID=TEST&serviceType=SSH&host=localhost&port=1050 with a WebSocket upgrade header
  • Expected Result: Connection refused or returns HTTP 400/403; HTTP 101 upgrade is not returned

Test Case 2: Path traversal rejected in hotfix workflow

  • Precondition: Apply platform hotfix; authenticate to AMC
  • Steps: POST to /rollbackConfirm.action with hotfix=../../../../tmp/test.sh
  • Expected Result: Request rejected with input validation error; no file execution occurs

Test Case 3: Credential integrity after rotation

  • Precondition: Rotate all passwords and TOTP tokens post-patch
  • Steps: Attempt login with the old credentials/tokens
  • Expected Result: All old credentials rejected; new credentials required

Automated Tests

The following shell script can be used to verify the SSRF endpoint is patched:

#!/bin/bash
TARGET="$1"

echo "[*] Testing CVE-2026-15409 SSRF endpoint on $TARGET..."

RESPONSE=$(curl -s -o /dev/null -w "%{http_code}" \
  --insecure \
  -H "Connection: Upgrade" \
  -H "Upgrade: websocket" \
  -H "Sec-WebSocket-Version: 13" \
  -H "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==" \
  "https://$TARGET/wsproxy?bmID=-3389c1b25ccd&serviceType=SSH&host=localhost&port=1050")

if [ "$RESPONSE" == "101" ]; then
  echo "[FAIL] HTTP 101 received — appliance may be VULNERABLE (CVE-2026-15409)"
  exit 1
else
  echo "[PASS] HTTP $RESPONSE received — SSRF endpoint appears patched or restricted"
  exit 0
fi

6. Prevention & Hardening

Best Practices

  • Patch network edge appliances on an emergency basis. VPN and remote access appliances are the highest-value targets for initial access brokers. Treat critical CVEs in these products as P0 regardless of broader patch cycles.
  • Never expose appliance management interfaces to the internet. AMC (port 8443) should only be reachable from trusted management networks or via an out-of-band access path.
  • Assume breach posture for unpatched internet-facing appliances. Any SMA1000 running vulnerable firmware with internet exposure should be treated as potentially compromised until forensic review confirms otherwise.
  • Implement network segmentation behind VPN concentrators. Limit what internal systems the appliance can reach directly. The observed lateral movement in this campaign exploited unrestricted access from the appliance to domain controllers.
  • Enroll in vendor security advisories. Subscribe to SonicWall PSIRT notifications (psirt.global.sonicwall.com) and CISA KEV feed to receive immediate alerts on newly exploited vulnerabilities.

Monitoring & Detection

Deploy the following detection rules in your SIEM or EDR:

Rule 1 — WebSocket SSRF attempt

extraweb_access.log CONTAINS "wsproxy" AND "host=localhost" AND status=101

Rule 2 — Hotfix path traversal attempt

ctrl-service.log CONTAINS "remove_hotfix" AND (".." OR "tmp")

Rule 3 — Credential database access

file_access.log CONTAINS "/tmp/temp.db"

Rule 4 — Lateral movement from appliance IP

Windows EventID=4624 AND LogonType=3 AND WorkstationName IN ("kali","DESKTOP-*") AND SourceIP=[SMA1000_INTERNAL_IP]

Rule 5 — Non-inventory hostnames in AD logons

Alert on NTLM authentications sourcing from the SMA1000 IP range where WorkstationName does not match your corporate hostname inventory.

References

Latest from the blog

See all →