SonicWall SMA Zero-Day Vulnerabilities Exploited by UTA0533 to Gain Root Access on VPN Devices

A newly identified threat actor tracked as UTA0533 has been linked to an advanced cyberattack campaign targeting SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances by chaining together two previously unknown zero-day vulnerabilities.

Security researchers discovered the activity during an incident response investigation in early July 2026 after detecting suspicious authentication attempts and lateral movement originating from compromised SMA devices.

The attackers successfully combined a critical server-side request forgery (SSRF) vulnerability with a command injection flaw to achieve full root-level command execution, allowing them to install persistent malware and maintain long-term access to affected systems.

SonicWall SMA Zero-Day Vulnerabilities Exploited

The attack leveraged CVE-2026-15409, a critical SSRF vulnerability with a CVSS score of 10.0, affecting the /wsproxy WebSocket component in SonicWall WorkPlace. This flaw enabled unauthenticated attackers to establish a WebSocket tunnel to services that were intended to be accessible only from localhost.

By crafting malicious requests containing the “SMA Connect Agent” user-agent and a specially formatted bmID parameter beginning with -3389, the attackers bypassed network restrictions and gained access to internal services such as CouchDB on port 1050 and the SMA control service running on port 8188. This internal access became the foundation for the second stage of the attack.

The second vulnerability, CVE-2026-15410, carries a CVSS score of 7.2 and affects the remove_hotfix workflow within the appliance’s ctrl-service.

The flaw combines path traversal with command injection, allowing attackers to execute arbitrary commands as the root user.

Researchers explained that once the attackers reached the internal services through the SSRF tunnel, they abused CouchDB’s default admin:admin credentials to upload a malicious script.

The script extracted the appliance’s hardware UUID from the system before invoking the vulnerable execRemoveHotfix function using a specially crafted traversal path, ultimately achieving unrestricted root-level execution.

According to incident responders, the complete attack chain consisted of five distinct stages. First, the attackers established a tunnel through the vulnerable /wsproxy endpoint. Next, they accessed CouchDB to read and write files on the appliance.

They then staged a malicious payload within the /tmp directory before reading the product_uuid file. Finally, they triggered the vulnerable remove_hotfix function to execute the uploaded script with root privileges.

This carefully orchestrated chain enabled the attackers to compromise the appliance without requiring valid authentication credentials.

The threat actor deployed several post-exploitation tools to maintain persistence and facilitate further attacks. Researchers observed the installation of a setuid privilege-escalation binary named ROOTRUN, along with a Python-based injector called KNUCKLEBALL.

The injector loaded two Java payloads into a legitimate SonicWall process, including the open-source proxy framework Suo5 and a custom Behinder-style webshell referred to as ORANGETAIL.

These implants allowed attackers to remotely execute commands, tunnel traffic, and maintain covert access to compromised appliances while blending in with legitimate processes.

To ensure long-term persistence, UTA0533 modified the appliance’s init.d startup scripts so that the malicious components would automatically launch after every reboot.

Investigators also found that the attackers altered nginx routing configurations, exposing their malicious implants through URLs disguised as legitimate login and logout endpoints.

On another compromised SMA appliance, forensic evidence revealed that the attackers executed tcpdump to capture unencrypted LDAP traffic, enabling them to harvest user credentials and potentially expand access into the victim’s internal network.

The campaign affects SonicWall SMA 1000 series models 6210, 7210, and 8200v running versions earlier than 12.4.3-03453 and 12.5.0-02835, both of which contain security fixes for the vulnerabilities.

The vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, highlighting the urgency of remediation.

SonicWall has emphasized that no workaround exists, making immediate patching essential. Security teams are advised to inspect appliances for unauthorized setuid binaries using the command find / -perm -4000, review /var/lib/unit/conf.json for suspicious proxy routes, and examine logs for unusual /wsproxy and /api requests.

Rapid7 has also confirmed active exploitation in the wild and recommends conducting a full forensic investigation or completely re-imaging any appliance suspected of compromise.

Researchers further noted that the attackers accessed webshells from more than 200 different IP addresses, many associated with commercial VPN providers, demonstrating deliberate efforts to conceal the campaign’s infrastructure and complicate attribution.