SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access
A threat actor, identified as UTA0533, successfully exploited multiple zero-day vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances to gain root access. The attacker leveraged these vulnerabilities – CVE-2026-15409 and CVE-2026-15410 – to install malware, establish persistence, and ultimately compromise the devices. The attack chain involved exploiting a WebSocket tunnel, accessing CouchDB to retrieve hardware identifiers, and then escalating privileges to achieve full control.
A previously undocumented threat actor, UTA0533, has been linked to the exploitation of recently disclosed SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances as zero-days prior to their public disclosure on June 22, 2026. Cybersecurity company Volexity is tracking the activity. The discovery followed an incident response investigation earlier this month, and the impacted organization has not been identified.
UTA0533 combined multiple zero-day vulnerabilities to compromise SonicWall SMA VPN appliances and obtain root-level access. The vulnerabilities exploited included CVE-2026-15409 (CVSS score: 10.0), a pre-authentication WebSocket bypass, and CVE-2026-15410 (CVSS score: 7.2), a path traversal flaw in the “remove_hotfix” workflow of “ctrl-service.”
The attack began with the creation of executable files, including /usr/bin/xzfind (a setuid binary allowing unprivileged users to execute commands as root) and /usr/lib/python3.11/site-packages/deploy_new.py (KNUCKLEBALL), which contained two JAR archives – Suo5 (an HTTP proxy) and ORANGETAIL (a custom Java web shell). These files were used to establish a WebSocket tunnel and interact with CouchDB.
Appliance 1 created /usr/bin/xzfind and /usr/lib/python3.11/site-packages/deploy_new.py, modifying the /etc/init.d/workplace startup script to establish persistence. It also added routes to Suo5 and ORANGETAIL in the NGINX Unit configuration file. Appliance 2 made similar modifications, though the routes did not return valid responses.
UTA0533 created multiple files in the /var/tmp directory, including lib.sh, which launched tcpdump to inspect unencrypted LDAP traffic and extract usernames and passwords. The attacker used the “couchdb” user to read the /sys/class/dmi/id/product_uuid file, bypassing authentication and gaining access to less-hardened services, such as localhost:1050 and localhost:8188.
UTA0533 leveraged a proof-of-concept exploit to achieve non-root remote code execution on SonicWall SMA 1000 devices by tunneling an Erlang protocol through the WebSocket for file read-write and arbitrary code execution via RPC calls. The attacker exploited CVE-2026-15409 to read the /sys/class/dmi/id/product_uuid file, enabling them to determine the password needed for authentication. Although the attacker did not use this bypass, they exploited CVE-2026-15410 to escalate privileges and gain command execution with elevated privileges.
“UTA0533 combined multiple zero-day vulnerabilities to compromise SonicWall SMA VPN appliances and obtain root-level access,” Volexity said. “With root access, the threat actor could access stored or cached credentials, capture network traffic, and potentially intercept credentials processed by the appliances.”
Despite demonstrating significant capability, available evidence suggests the threat actor was less successful moving laterally or gaining access to other systems.