SonicWall SMA Zero-Days Let Attackers Turn One WebSocket Request Into Root Control

SonicWall SMA Secure Mobile Access appliances are again at the center of a zero-day storm, with chained flaws that let attackers turn a single crafted WebSocket request into root-level control on internet-facing VPN gateways.

The campaign, dissected by Volexity and other researchers, shows how a previously undocumented threat actor, tracked as UTA0533, abused SonicWall’s wsproxy service to tunnel into localhost-only services and then pivot to full system compromise.

At the heart of the incident are two zero-day vulnerabilities in SonicWall SMA 1000 series devices, now tracked as CVE-2026-15409 and CVE-2026-15410.

CVE-2026-15409, rated CVSS 10.0, is a pre-authentication flaw in the WorkPlace WebSocket proxy (/wsproxy). It allows an unauthenticated attacker to open a WebSocket tunnel from the internet directly to internal services bound only to localhost on the appliance.

By sending a /wsproxy request that mimics the SMA Connect Agent client including a specific User-Agent string and a bmID parameter beginning with -3389 the adversary can trick the proxy into wiring that one WebSocket connection straight to privileged internal ports.

In practice, this turns the remote SMA gateway into its own SSRF victim: the attacker fully controls the tunnel’s destination host and port and can reach services that were never meant to be exposed externally, including the Erlang distribution port used for internal RPC.

From there, the exploitation path is brutally efficient. Volexity’s reconstruction shows the actor using the unauthenticated WebSocket tunnel to speak the Erlang protocol to the internal node, completing the standard handshake with a hardcoded cookie that is identical across appliances.

Once the handshake succeeds, they issue arbitrary RPC calls such as os:cmd/1 and file operations, gaining remote code execution as the low-privilege couchdb user and the ability to read and write files on the device.

That alone is enough to stage a payload in /tmp that reads sensitive identifiers like the DMI product UUID, but the chain does not stop there.

SonicWall SMA Zero-Days

The second zero-day, CVE-2026-15410, is a path traversal flaw in the hotfix-removal workflow of SonicWall ctrl-service (sysCtrl.execRemoveHotfix).

By abusing this logic, UTA0533 was able to coerce the appliance into executing the staged payload as root, effectively turning their previously non-root WebSocket foothold into full system-level command execution.

In other words, one unauthenticated WebSocket request to /wsproxy correctly crafted with the right parameters became the front door to a complete root compromise of a critical remote access gateway.

Resecurity Researchers said that, Volexity with root access, the actor harvested plaintext LDAP credentials, accessed stored or cached secrets, and positioned themselves to intercept authentication traffic passing through the VPN appliance.

SonicWall has since released patches and a public advisory for SMA 1000 appliances, confirming that CVE-2026-15409 and CVE-2026-15410 were exploited as genuine zero-days in the wild before disclosure.

Incident-response timelines suggest at least a multi-week window where organizations had no vendor fix while UTA0533 quietly held root on exposed gateways.

The attack chain maps cleanly to MITRE ATT&CK techniques for exploiting public-facing applications and privilege escalation, and aligns with a broader pattern of edge-device exploitation that has previously hit SonicWall SSL-VPN and SMA 100-series platforms via both zero-days and N-days.

For defenders, the message is stark. SMA 1000 gateways must be patched to the latest firmware that addresses CVE-2026-15409 and CVE-2026-15410, and environments should be urgently reviewed for signs of compromise, including anomalous /wsproxy traffic, unexpected Erlang RPC activity, and evidence of custom malware families like KnuckleBall, OrangeTail, and Suo5 deployed by this actor.

Given the pre-authentication nature of the chain and its end state of root, organizations should treat exposed SMA appliances as high-risk assets, rotate credentials processed through these devices, and consider architecting remote access so that a single WebSocket proxy bug cannot again translate into complete network control.

IOCs

#	IP address
1	42.200.172.14
2	81.19.140.217
3	89.117.20.1
4	108.205.8.173
5	147.45.51.19
6	150.241.210.53
7	202.8.105.201
8	217.77.15.99

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

$1M Data Breach Warranty is Genuine Protection?: Download 10 Point Free AI SOC Breach Warranty Guide