Full research report

CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

SonicWall SMA 1000 series VPN appliances have been subject to a compounding exploitation pattern across late 2025 and mid-2026, with adversaries — ranging from sophisticated initial-access specialists to financially motivated ransomware groups — consistently targeting the platform's internet-facing management and access interfaces. The June–July 2026 campaign is notable for the depth of UTA0533's platform-specific malware development: four purpose-built tools designed to survive appliance reboots via legitimate startup mechanisms, maintain covert reverse-proxy tunnels, and execute encrypted payloads without persistent disk artefacts. The rapid transition from a specialised, technically sophisticated actor to broad ransomware adoption reflects a now-well-documented pattern in which novel enterprise VPN zero-days are quickly absorbed into cybercriminal operations, either through direct actor overlap or via initial-access broker markets. With over 380 appliances still internet-exposed per Shadowserver as of August 2026, the gap between patch availability and operational remediation remains significant, particularly given the product's deployment in government and managed-service-provider environments where a single compromised appliance can provide access to multiple downstream organisations. Defenders should treat SonicWall SMA1000 compromise assessment — not merely patch application — as the priority, given the three-week pre-disclosure exploitation window during which persistent access could have been established.

What happened

Two critical zero-day vulnerabilities in SonicWall's SMA 1000 series secure remote access gateways — CVE-2026-15409 (SSRF, CVSS 10.0) and CVE-2026-15410 (command injection, CVSS 7.2) — were exploited in coordinated attacks beginning 22 June 2026, over three weeks before SonicWall publicly disclosed and patched them on 14 July 2026. The previously unknown threat cluster UTA0533 was the first identified exploiter, deploying a bespoke four-component malware toolkit to establish persistent covert access. By August 2026, CISA updated its Known Exploited Vulnerabilities catalogue to confirm ransomware gangs had also weaponised the flaws, with Resecurity identifying INC Ransomware as the dominant actor. A separate vulnerability, CVE-2025-40602, affecting the SMA1000 Appliance Management Console, was confirmed exploited in distinct zero-day attacks in December 2025, illustrating a sustained pattern of adversarial interest in the SMA1000 platform.

Affected scope

SonicWall SMA 1000 Series appliances — models 6210, 7210, and 8200v — running firmware prior to 12.4.3-03453 or 12.5.0-02835. Affected builds include 12.4.3-03245, 12.4.3-03387, 12.4.3-03434 and 12.5.0-02283, 12.5.0-02624, 12.5.0-02800. Shadowserver tracked over 380 SMA1000 appliances exposed on the public internet as of August 2026. Confirmed victims include enterprises, government entities, and managed service providers across Australia, the United States, the United Arab Emirates, Colombia, and Switzerland.

Technical assessment

CVE-2026-15409 allows an unauthenticated attacker to abuse the /wsproxy WebSocket endpoint to tunnel traffic to localhost-only services — including a CouchDB instance accessible with default administrative credentials — bypassing the network isolation intended to protect internal management interfaces. CVE-2026-15410 then permits code execution at root level via path-traversal in an administrative hotfix-removal function within the Appliance Management Console. The chained result is unauthenticated root-level appliance compromise from the public internet. UTA0533 exploited this chain to install KNUCKLEBALL (a Python dropper injecting malware into legitimate SonicWall processes), Sou5 (a modified reverse proxy for persistent covert tunnelling), ORANGETAIL (a Java webshell modelled on the Behinder framework, using AES-128-ECB encrypted payloads), and ROOTRUN (a setuid binary enabling root command execution). The platform's role as a VPN gateway means a compromised appliance gives an attacker a vantage point into the internal networks of all connected organisations.

Recommended defensive actions

  1. Patch SonicWall SMA1000 appliances immediately to firmware 12.4.3-03453 or 12.5.0-02835 or any later fixed build for the relevant branch.
  2. Hunt SMA1000 appliance logs for /wsproxy requests where the bmID parameter begins with -3389 and the server returned HTTP status 101, which Volexity identified as the exploitation indicator.
  3. Inspect the SMA1000 file system for unexpected files in /tmp and /var/tmp, deploy_new.py in /usr/lib/python3.11/site-packages/, modified /var/lib/unit/conf.json NGINX configuration, and setuid binaries outside standard system paths.
  4. Rotate all administrative credentials and TOTP tokens on any appliance that may have been exposed to the internet during the vulnerable window (before the July 14 patch).
  5. Restrict Appliance Management Console access to specific administrator IP addresses or a dedicated management network segment, removing it from public internet exposure regardless of patch status.

Uncertainties and evidence gaps

  • The relationship between the initial UTA0533 intrusion cluster and INC Ransomware has not been definitively established; it is unknown whether UTA0533 sold access, operates as an initial-access broker for INC, or whether INC independently discovered and exploited the vulnerabilities.
  • INC Ransomware's figure of 885 claimed victims originates from the group's own data leak site and may be inflated; the independently verified victim count is not published.
  • SonicWall had not updated its original July 2026 advisory to confirm ransomware exploitation as of the August 10 reporting date, leaving a gap between government and vendor disclosure.
  • Whether CVE-2025-40602 is being actively chained with CVE-2026-15409 or CVE-2026-15410 in the current ransomware campaign is not confirmed in any published evidence reviewed.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessUnauthenticated, remote access to the SMA1000 Workplace interface over the public internet; the Appliance Management Console is then reached through the tunnel established by the SSRF flaw
ComponentSMA1000 /wsproxy WebSocket endpoint (Workplace interface) chained with the sysCtrl.execRemoveHotfix RPC method in the Appliance Management Console
MechanismThe SSRF flaw permits unauthenticated WebSocket tunnels to internal-only services, exposing a CouchDB instance with default credentials and the management console; the command injection flaw uses path traversal in an administrative function to execute attacker-supplied scripts as root
ImpactFull, persistent root-level control of the VPN appliance, enabling interception of remote access sessions, credential harvesting, lateral movement into connected internal networks, and ransomware payload deployment
DetectionAnomalous /wsproxy requests with bmID starting with -3389 and HTTP 101 status; ctrl-service.log entries referencing remove_hotfix with traversal sequences; unexpected Python or JAR files in system package directories; setuid binaries outside standard system paths; unexplained modifications to /var/lib/unit/conf.json
MitigationUpgrade to SonicWall SMA1000 firmware 12.4.3-03453 or 12.5.0-02835 or later; restrict AMC to administrator-specific IP ranges; remove the management interface from public internet exposure
Exploitation status

CVE-2026-15409 and CVE-2026-15410 have confirmed active exploitation in the wild since at least 22 June 2026, including confirmed ransomware use by INC Ransomware as of August 2026; CVE-2025-40602 was separately confirmed exploited in zero-day attacks in December 2025 and is historical context for this story.

Research process

The investigation began with CISA and BleepingComputer reporting confirming that two SonicWall SMA1000 zero-days had progressed to ransomware exploitation. Targeted searches identified independent corroboration from Rapid7, Tenable, and Volexity. Fetching the Volexity primary research post confirmed the pre-disclosure exploitation timeline and malware details with the strongest technical evidence. The Hacker News article on INC Ransomware provided the only named ransomware actor, sourced from Resecurity. The principal unresolved question — the relationship between UTA0533 and INC Ransomware — has no published resolution.

  1. What does the primary reporting confirm about exploitation status and involved CVEs?
    Fetched the BleepingComputer article linked in the source material
    bleepingcomputer.com ↗

    Confirmed CVE-2026-15409 (SSRF) and CVE-2026-15410 (command injection) as the 2026 vulnerabilities; UTA0533 attributed as initial actor; KNUCKLEBALL, Sou5, ROOTRUN, and ORANGETAIL named; CISA KEV added July 14; ransomware exploitation confirmed by CISA on August 10.

    why Established core facts and named entities, distinguishing the initial espionage-style campaign from the subsequent ransomware wave.

  2. What independent sources cover CVE-2026-15409 and CVE-2026-15410?
    Searched for both CVE identifiers alongside SonicWall SMA1000 and 2026

    Multiple independent advisory sources returned: Rapid7, Tenable, Arctic Wolf, Help Net Security, eSentire. CVSS 10.0 for CVE-2026-15409 and 7.2 for CVE-2026-15410 confirmed across sources.

    why Established that multiple vendors independently verified severity and exploitation status, satisfying the corroboration requirement.

  3. What did Volexity publish on UTA0533 and the malware arsenal?
    Searched for UTA0533, KNUCKLEBALL, ORANGETAIL, and Volexity together to locate the primary research post

    Located the Volexity blog post directly, alongside BleepingComputer's reporting on the malware campaign. Confirmed June 22 as the earliest compromise date.

    why Identified Volexity's post as the key primary technical source to verify directly before citing.

  4. Does the Volexity technical report substantiate the exploitation timeline, actor attribution, and malware details?
    Fetched the Volexity blog post
    volexity.com ↗

    Confirmed exploitation from June 22; KNUCKLEBALL injects Sou5 and ORANGETAIL into legitimate SonicWall processes; ROOTRUN is a setuid ELF binary with a published SHA256 hash; ORANGETAIL is modelled on the Behinder webshell using AES-128-ECB encryption; log and file-system IOCs documented in detail.

    why This is the strongest independent technical source. It directly supports pre-disclosure zero-day exploitation by a previously unknown actor and provides actionable IOCs for defenders.

  5. Which ransomware group has CISA's August 2026 update identified as exploiting these vulnerabilities?
    Fetched The Hacker News article on INC Ransomware and the SonicWall SMA1000 campaign
    thehackernews.com ↗

    Resecurity identified INC Ransomware as the dominant actor, citing 885 claimed victims (self-reported by the group) across Australia, US, UAE, Colombia, and Switzerland as of early August 2026. The link between UTA0533 and INC Ransomware is not definitively established in published research.

    why Corroborates the ransomware angle and names the specific group; the unverified victim count and uncertain actor linkage are surfaced as material uncertainties.

  6. What are the precise affected and patched firmware versions?
    Fetched the Rapid7 emergency advisory
    rapid7.com ↗

    Vulnerable builds: 12.4.3-03245, 12.4.3-03387, 12.4.3-03434 and 12.5.0-02283, 12.5.0-02624, 12.5.0-02800. Fixed in 12.4.3-03453 and 12.5.0-02835. Affected hardware models: 6210, 7210, 8200v.

    why Provides the specific version table defenders need to determine whether their appliances require patching and to verify patch compliance.

  7. Does an independent vendor confirm CVSS scores and the absence of a public PoC?
    Fetched the Tenable advisory
    tenable.com ↗

    Confirmed CVSS 10.0 and 7.2 independently. Tenable explicitly stated no public proof-of-concept was available at publication time, and noted detection plugins are available.

    why Second independent source confirming severity; the absence of a public PoC is material to risk framing and must be confirmed rather than assumed.

  8. What is CVE-2025-40602's exploitation context and how does it relate to the current campaign?
    Searched for CVE-2025-40602 alongside SonicWall SMA1000, December 2025, and chained exploitation

    CVE-2025-40602 (CVSS 6.6, local privilege escalation in SMA1000 AMC) was confirmed exploited in December 2025, chained with CVE-2025-23006 (CVSS 9.8 unauthenticated RCE). Discovered by Google's Threat Intelligence Group. No confirmed chaining with the 2026 CVEs in published evidence.

    why Separates CVE-2025-40602 as a prior campaign, preventing conflation with the 2026 ransomware events and clarifying the CISA KEV entry's historical nature.

Named in this story
ActorsUTA0533INC Ransomware
MalwareKNUCKLEBALLSou5ROOTRUNORANGETAIL
Targetsenterprise organisationsgovernment agenciesmanaged service providersorganisations in Australia, United States, United Arab Emirates, Colombia, and Switzerland
Related CVEs CVE-2026-15409CVE-2026-15410CVE-2025-40602

Research coverage

All 68 registered source leaves were evaluated for this run: 58 completed, 0 were unavailable, 3 failed and 7 were disabled. For this story, 5 registered sources supplied useful evidence (3 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 53 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
BleepingComputernews ok10 records Primary evidence3 matched items Published the source report used to frame and date the event. Supplied a vendor or government advisory opened and verified during focused research. Supplied independent analysis opened and verified during focused research.
CISA KEVkev ok1662 records Primary evidence3 matched items Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue.
Rapid7news ok empty0 records Primary evidence1 matched items Supplied a vendor or government advisory opened and verified during focused research.
CISA Alertsnews ok empty0 records Corroborating1 matched items A page from this source was opened and verified during focused research.
FIRST EPSSepss ok7588 records Context3 matched items Added exploitation-probability context; EPSS does not itself prove exploitation.
AlienVault OTXdark_web failed0 records Failed The current collection attempt failed; this source cannot support the report.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5322 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok678 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1008 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch failed0 records Failed The current collection attempt failed; this source cannot support the report.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok12 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok16 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok13 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1453 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok2 records Checked — no match The source completed, but none of its retained records matched this story.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok7 records Checked — no match The source completed, but none of its retained records matched this story.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
The Hacker Newsnews ok8 records Checked — no match The source completed, but none of its retained records matched this story.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch failed3 records Failed The current collection attempt failed; this source cannot support the report.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 3 opened outside the registered collection
References & evidence
Vulnerability & exploitation6
CVE-2026-15410 CISA KEV SonicWall SMA1000 Appliances · added 2026-07-14 · used in ransomware CISA catalog ↗
CVE-2026-15409 CISA KEV SonicWall SMA1000 Appliances · added 2026-07-14 · used in ransomware CISA catalog ↗
CVE-2025-40602 CISA KEV SonicWall SMA1000 appliance · added 2025-12-17 CISA catalog ↗
CVE-2025-40602 EPSS 2.0% 79th percentile exploitation probability
CVE-2026-15409 EPSS 78.4% 100th percentile exploitation probability
CVE-2026-15410 EPSS 76.3% 99th percentile exploitation probability
PoC & exploit code1
Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation — Volexity volexity.com ↗

Detailed technical write-up with malware IOCs, file hashes (including ROOTRUN SHA256), log signatures, and network indicators; not a weaponisable exploit, no public PoC code published

Vendor & gov advisories3
CISA: SonicWall SMA1000 Flaws Now Exploited by Ransomware Gangs — BleepingComputer bleepingcomputer.com ↗

Reports CISA's August 2026 KEV update flagging ransomware exploitation of CVE-2026-15409 and CVE-2026-15410

SonicWall SMA1000 Zero Days CVE-2026-15409 and CVE-2026-15410 — Rapid7 rapid7.com ↗

Rapid7 advisory with confirmed affected firmware builds and fixed versions

CVE-2026-15409 and CVE-2026-15410 SonicWall SMA 1000 Zero-Days — Tenable tenable.com ↗

Independent vendor advisory confirming CVSS 10.0 and 7.2 scores and absence of public PoC at publication

Analysis & research3
Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation — Volexity volexity.com ↗

Primary technical investigation attributing pre-disclosure zero-day exploitation to UTA0533 with full malware family analysis

INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws — The Hacker News thehackernews.com ↗

Resecurity research naming INC Ransomware as the primary ransomware group weaponising the vulnerability chain, with 885 claimed victims as of early August 2026

SonicWall SMA1000 Flaws Exploited as Zero-Days to Push Custom Malware — BleepingComputer bleepingcomputer.com ↗

Corroborating reporting on the UTA0533 campaign, malware arsenal, and Volexity attribution