SonicWall disclosed two actively exploited zero-day vulnerabilities in SMA1000 series remote access appliances on July 14 2026. CVE-2026-15409 a maximum severity SSRF (CVSS 10.0) enables unauthenticated attackers to open WebSocket tunnels to internal services. CVE-2026-15410 a path traversal in hotfix removal (CVSS 9.8) chains to achieve root RCE. Both are in CISA KEV catalog.

Vulnerability Details

CVE-2026-15409 SSRF via WebSocket Proxy (CVSS 10.0 Critical)

The flaw resides in the WebSocket proxy feature accessible via the /wsproxy path on the SonicWall WorkPlace application served on port 443. By supplying host values pointing to localhost (host=0.0.0.0 host=localhost host=::ffff:127.0.0.1) an unauthenticated attacker can reach internal system services normally shielded by the firewall.

Key internal services exposed:

• Erlang application on port 1050
• ctrl-service on port 8188

Rapid7 researchers demonstrated remote code execution against the Erlang process using a hardcoded authentication cookie requiring no credentials.

CVE-2026-15410 Path Traversal in Hotfix Removal (CVSS 9.8 Critical)

This vulnerability exists in the remove_hotfix workflow of ctrl-service accessible via port 8188 or the web console. Attackers supply a malicious hotfix path such as ../../../../var/tmp/privesc which the system executes as root typically followed by an appliance reboot.

Exploitation Chain

1. Attacker accesses /wsproxy with localhost host parameter (CVE-2026-15409)
2. Reaches ctrl-service on port 8188 through WebSocket tunnel
3. Exploits path traversal in remove_hotfix (CVE-2026-15410)
4. Achieves root code execution on appliance
5. Harvests credentials session databases TOTP MFA seeds
6. Uses appliance as VPN-less backdoor into internal network

Impact Assessment

Active exploitation observed by Rapid7 MDR team before public disclosure. Threat actors used compromised appliances as stealthy initial access points harvesting:

• User and administrator credentials
• Session databases
• TOTP MFA seeds
• VPN-less AD authentications from appliance IPs with non-inventory hostnames (e.g. kali)

CISA added both CVEs to KEV catalog. Federal agencies must remediate immediately.

Affected Products

Model Series	Affected Versions
SMA1000 6210	12.4.3-03245 through 12.4.3-03434 12.5.0-02283 through 12.5.0-02800
SMA1000 7210	12.4.3-03245 through 12.4.3-03434 12.5.0-02283 through 12.5.0-02800
SMA1000 8200v	12.4.3-03245 through 12.4.3-03434 12.5.0-02283 through 12.5.0-02800

SSL VPN functionality on SonicWall firewalls and SMA 100 series are NOT affected.

Mitigation and Patching

Fixed versions:

• 12.4.3-03453 (platform-hotfix) or later
• 12.5.0-02835 (platform-hotfix) or later

No workarounds exist. SonicWall urges immediate application of platform hotfix releases.

Post-Compromise Actions

If compromise is confirmed or suspected:

1. Conduct forensic review for indicators of compromise
2. Re-image or redeploy appliances
3. Reset all user and administrator passwords
4. Reset TOTP MFA seeds following confirmed compromise
5. Review Active Directory logs for anomalous authentications from appliance IPs

Detection

Indicators of Compromise

Category	Indicator Pattern	Log Source
WebSocket exploit (CVE-2026-15409)	GET + wsproxy + =-3389 + 101	extraweb_access.log
Suspicious host values	host=0.0.0.0 host=localhost host=::ffff:127.0.0.1	/wsproxy requests
Hotfix removal exploit (CVE-2026-15410)	/usr/local/bin/remove_hotfix with traversal e.g. ../../../../../../tmp/sma1000_5c47.sh	ctrl-service.log
Config artifact	/var/lib/unit/conf.json with unauthorized /__api__/login or /__api__/logout routes	Appliance config
AD/service account compromise	NTLM logons Event ID 4624 type 3 from appliance IP non-inventory hostnames (e.g. kali) no VPN session	Domain controller logs
Atomic ASN	F.N.S Holdings Limited (ASN 206092)	Network/firewall logs
Atomic IP ranges	45.131.194.0/24 45.146.54.0/24 63.135.161.0/24 173.239.211.0/24	Network/firewall logs

Note: IP addresses and domains intentionally defanged. Re-fang only within controlled threat intelligence platforms (MISP VirusTotal SIEM).

Network Monitoring

• Alert on WebSocket connections to /wsproxy with localhost host headers
• Monitor for unusual outbound connections from SMA appliances
• Correlate appliance IPs with AD authentication anomalies

Frequently Asked Questions

Are SonicWall firewalls affected?

No. SSL VPN on SonicWall firewalls and SMA 100 series are not affected. Only SMA1000 series models 6210 7210 and 8200v.

Can I disable the WebSocket proxy as a workaround?

No workarounds exist per SonicWall. The vulnerability is in a core component. Patching is the only mitigation.

How do I know if I'm compromised?

Check extraweb_access.log for WebSocket exploit patterns review ctrl-service.log for hotfix removal anomalies examine /var/lib/unit/conf.json for unauthorized API routes correlate appliance IPs with AD Event ID 4624 logons from unknown hostnames.

What is the exploitability assessment?

CVE-2026-15409 CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - network attack low complexity no privileges no user interaction scope changed high impact. CVE-2026-15410 CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - similar but scope unchanged.

Both have public PoC (Python for CVE-2026-15409) and Metasploit module in development.

What should I do if I cannot patch immediately?

No mitigation exists. Isolate appliances from internet exposure if possible. Monitor logs intensively. Plan emergency maintenance window for hotfix application.

Key Takeaways

• Two critical zero-days CVE-2026-15409 (SSRF CVSS 10.0) and CVE-2026-15410 (path traversal RCE CVSS 9.8) actively exploited in SMA1000 appliances
• Attack chain: WebSocket proxy SSRF -> internal ctrl-service -> root RCE via hotfix removal
• Compromised appliances used as VPN-less backdoors harvesting credentials MFA seeds session data
• CISA KEV catalog inclusion mandates immediate federal remediation
• Fixed versions: 12.4.3-03453 and 12.5.0-02835 or later
• No workarounds exist patching is mandatory

---

---

Sources:

• CyberPress Critical SonicWall SSRF Zero-Day Opens WebSocket Tunnel to Internal Services
• Rapid7 Blog ETR Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero-Days Being Actively Exploited
• SonicWall Security Advisory SWV-2026-0001
• CISA Known Exploited Vulnerabilities Catalog