A VPN gateway often becomes the first entry point into the inner network, and in the summer of 2026, attackers used two unknown vulnerabilities of SonicWall Secure Mobile Access to gain full control over the devices. The attack was discovered after suspicious attempts to enter and move over the network, and the earliest traces of the hacking date back to June 22.
SonicWall SMA 1000 series 6210, 7210 and 8200v were hit. Vulnerability CVE-2026-15409 (10.0 on the CVSS 3.1) scale allowed without authorization to create a tunnel to internal gateway services that are usually not available from the Internet. Through such a tunnel, the attackers connected to the local CouchDB base and the device control service.
Then the attackers read the system identifier of the device and used CVE-2026-15410 (7.2 on the CVSS 3.1) scale to run a prepared file with superuser rights. The error allowed to transfer the control service the path outside the permitted catalog, which is why the lock performed an arbitrary script on the name of root.
After hacking, the UTA0533 group installed several malicious components. The KNUCKLEBALL program has implemented the SonicWall Proxy Suo5 and the ORANGETAIL web membrane. The attackers then added hidden routes to the NGINX configuration and access malicious functions through externally ordinary input and output addresses.
On one of the devices, the attackers launched tcpdump and intercepted unencrypted LDAP traffic to extract usernames and passwords. The attackers also tried to connect from a hacked VPN gateway to other organizations’ systems. However, the collected data show that further progress on the internal network was limited.
SonicWall has closed both vulnerabilities in versions 12.4.3-03453 and 12.5.0-02835. Owners of SMA 1000 are advised to urgently install updates, check the logs of calls to /wsproxy, study the directories /tmp and /vv/tmp, find unknown routes in the NGINX configuration and check the system for extraneous files with superuser rights.
SonicWall SMA 1000 series 6210, 7210 and 8200v were hit. Vulnerability CVE-2026-15409 (10.0 on the CVSS 3.1) scale allowed without authorization to create a tunnel to internal gateway services that are usually not available from the Internet. Through such a tunnel, the attackers connected to the local CouchDB base and the device control service.
Then the attackers read the system identifier of the device and used CVE-2026-15410 (7.2 on the CVSS 3.1) scale to run a prepared file with superuser rights. The error allowed to transfer the control service the path outside the permitted catalog, which is why the lock performed an arbitrary script on the name of root.
After hacking, the UTA0533 group installed several malicious components. The KNUCKLEBALL program has implemented the SonicWall Proxy Suo5 and the ORANGETAIL web membrane. The attackers then added hidden routes to the NGINX configuration and access malicious functions through externally ordinary input and output addresses.
On one of the devices, the attackers launched tcpdump and intercepted unencrypted LDAP traffic to extract usernames and passwords. The attackers also tried to connect from a hacked VPN gateway to other organizations’ systems. However, the collected data show that further progress on the internal network was limited.
SonicWall has closed both vulnerabilities in versions 12.4.3-03453 and 12.5.0-02835. Owners of SMA 1000 are advised to urgently install updates, check the logs of calls to /wsproxy, study the directories /tmp and /vv/tmp, find unknown routes in the NGINX configuration and check the system for extraneous files with superuser rights.
