SonicWall SMA Zero-Day Flaws Exploited by UTA0533 to Gain Root VPN Access

Volexity’s incident response team has pulled back the curtain on one of the more inventive VPN appliance compromises of 2026, detailing how a threat actor tracked as UTA0533 chained multiple zero-day vulnerabilities to seize root-level control of SonicWall Secure Mobile Access (SMA) 1000 series appliances.

The findings, published July 17, 2026, follow SonicWall’s public disclosure three days earlier and reveal an exploitation path that progressed from an unauthenticated WebSocket bypass to arbitrary code execution as root.

Volexity was called in after a customer noticed suspicious authentication and lateral movement attempts originating from their SonicWall SMA appliances.

SonicWall SMA Zero-Day Flaws

Forensic analysis of two compromised devices supported by memory captures via Surge Collect Pro and Volcano traced the earliest signs of compromise to June 22, 2026.

The attackers exploited affected models 6210, 7210, and 8200v, targeting a hotfix later rolled into firmware versions 12.4.3-03453 and 12.5.0-02835.

Two CVEs anchor the attack:

CVE-2026-15409 (SSRF): An unauthenticated bypass through the /wsproxy endpoint. By spoofing the SMA Connect Agent user-agent and using a bmID parameter prefixed with -3389, attackers could tunnel WebSocket connections directly to localhost-only services, no valid session cookie required.
CVE-2026-15410 (Command Injection): A path traversal flaw in sysCtrl.execRemoveHotfix, which builds a rollback file path from attacker-controlled input. Supplying a traversal string like ../../../../../tmp/1234.sh tricked the appliance into executing arbitrary scripts as root.

Between these two flaws sat a critical pivot point: SonicWall’s bundled CouchDB instance, reachable via the WebSocket tunnel, still used default admin:admin credentials.

This allowed the threat actor to write a staging script as the low-privileged couchdb user, read the appliance’s hardware UUID, and ultimately trigger the path traversal exploit for root execution.

SonicWall SMA Zero-Day Flaws Exploited by UTA0533 to Gain Root VPN Access

KNUCKLEBALL, ROOTRUN, and ORANGETAIL

Once inside, UTA0533 deployed purpose-built tooling rather than off-the-shelf malware alone:

ROOTRUN (xzfind): A compact setuid ELF binary that elevates to root via setuid() before executing shell commands.
KNUCKLEBALL (deploy_new.py): A Python injector that hijacked the legitimate workplace.startup.CommandStartup Java process using the Java Attach API to inject two JAR payloads directly into memory.
Suo5: An open-source HTTP tunneling proxy, repurposed with added user-agent gating for stealth.
ORANGETAIL: A custom webshell modeled on the well-known Behinder tool, but hardened with hand-rolled AES encryption, reflective class loading, and a hardcoded “gate” user-agent string to dodge casual detection.

Persistence was achieved by quietly appending a single line to the legitimate /etc/init.d/workplace startup script, an elegant, low-footprint technique that let the implant survive reboots without obvious new files.

“This intrusion is a reminder that zero-days rarely operate alone; it’s the seams between components, like a decade-old default database credential sitting quietly behind a WebSocket proxy, that turn a single bug into a full compromise chain. Vendors need to treat every bundled service, no matter how internal it seems, as part of the attack surface.”

With root access secured, UTA0533 didn’t stop at the appliance. The group ran tcpdump to sniff unencrypted LDAP traffic destined for internal directory servers, harvesting credentials in transit.

Attempts to pivot deeper into victim networks followed, though Volexity notes these lateral movement efforts appear to have had limited success.

Notably, the attackers operated from over 200 IP addresses, including several associated with commercial VPN services such as ExpressVPN and Mullvad, as well as leaked Windows and Kali Linux hostnames that hint at the operators’ tooling.

Volexity has published YARA rules and specific IOCs, including log signatures for /wsproxy abuse, webshell access patterns, and suspicious nginx route modifications in /var/lib/unit/conf.json.

Organizations running affected SMA models should prioritize patching to the fixed firmware versions immediately, audit for unexpected setuid binaries via find / -perm -4000, and inspect /tmp and /var/tmp for anomalous files tied to the June-July 2026 window.