Summary
Two zero-day vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances — CVE-2026-15409 (SSRF, CVSS 10.0) and CVE-2026-15410 (code injection, CVSS 7.2) — were actively exploited in the wild starting as early as June 22, 2026, weeks before SonicWall disclosed and patched them on July 14. The threat actor behind the campaign is tracked as UTA0533.
Chaining the two flaws gives attackers root-level command execution on the appliance. After gaining initial access, UTA0533 deployed a custom toolkit: the Knuckleball and Rootrun malware implants and an Orangetail webshell. From there, attackers extracted high-value credentials and attempted lateral movement into victim networks. CISA added both CVEs to its KEV catalog with a federal patch deadline of July 17, 2026. Affected firmware versions include the 12.4.3 and 12.5.0 branches; fixed versions are 12.4.3-03453+ and 12.5.0-02835+.
SonicWall advises that organizations unable to confirm clean patching should treat the device as compromised: re-image physical appliances, redeploy virtual ones, rotate all credentials, and reset TOTP tokens.
Source
Rapid7 MDR ETR
The Hacker News
SecurityWeek
Help Net Security
Commentary
Three weeks of undetected exploitation before a patch exists is a brutal timeline, especially on VPN concentrators that sit at the perimeter of corporate networks. The custom malware toolkit — webshell plus two implants — signals this isn’t opportunistic scanning; it is a targeted campaign with post-exploitation objectives. Any organization running SMA 1000 appliances on affected firmware needs to treat this as an active incident, not just a patch event.
The SSRF + code injection chain is a classic escalation pattern: the SSRF creates unauthenticated reach into the management console, the code injection converts that into OS command execution. Defenders should look for unusual outbound connections from SMA appliances, unexpected configuration changes, and any presence of the Orangetail webshell before declaring all-clear post-patch.