SonicWall SMA Zero-Days Exploited to Gain Root Access
Threat actors exploited newly discovered vulnerabilities in SonicWall SMA VPN devices.
1Zero-Day Vulnerabilities Discovered
Two critical vulnerabilities, CVE-2026-15409 and CVE-2026-15410, were found in SonicWall Secure Mobile Access (SMA) 1000 series VPN devices before public disclosure. These flaws allowed root access. Cybersecurity firm Volexity attributed the exploits to a threat actor dubbed UTA0533.
2Threat Actor's Methods
UTA0533 used malware specifically designed for SonicWall SMA devices and multiple zero-day exploits. Attackers planted ELF executables and Python scripts to maintain persistence, modifying NGINX Unit configurations to create backdoors and gain full control over the systems.
3Technical Details of the Flaws
CVE-2026-15409 enables unauthorized WebSocket tunneling to local services, while CVE-2026-15410 involves command injection and privilege escalation. Combined, these vulnerabilities allow complete device takeover. SonicWall has released patches to address these issues.
4Impact of the Attack
Attackers intercepted unencrypted LDAP traffic to steal credentials. They also exploited CouchDB to read hardware IDs and bypass authentication. These techniques provided full system access, highlighting severe security weaknesses in the affected devices.
5Recovery and Mitigation
The compromised organization rebooted devices to remove memory-resident malware. However, persistent files may require a factory reset for complete cleanup. SonicWall urges users to apply the latest patches immediately to prevent further exploitation.
6Critical Cybersecurity Alert
This attack underscores the critical nature of VPN devices as high-value targets. Organizations must adopt proactive measures against zero-day exploits and implement continuous monitoring. Analyses by firms like Volexity and Rapid7 provide vital insights for preventing similar breaches.