SonicWall VPN appliances were backdoored for weeks before the flaws were disclosed

Incident response firm Volexity detailed how attackers chained two SonicWall SMA1000 flaws as zero-days weeks before the vendor disclosed them, reaching root and installing malware built specifically for the appliances. A previously unknown actor it tracks as UTA0533 began exploiting on June 22, nearly three weeks before the July 14 advisory. The chain starts with CVE-2026-15409 against the /wsproxy endpoint, letting an unauthenticated attacker open WebSocket tunnels to services meant to be reachable only from the appliance itself, then uses CVE-2026-15410 for command execution. With root, the actor could read stored credentials, capture traffic, and intercept credentials the appliance processes.

Check

Patch SMA1000 appliances to the fixed releases, then check them against Volexity's published indicators, since patching alone does not remove an implant left during the pre-disclosure exploitation window.

Affected

Organizations running SonicWall SMA1000 6210, 7210, or 8200v appliances (CVE-2026-15409, CVE-2026-15410); attackers held root before patches existed, with malware purpose-built for these devices and access to processed credentials.

Fix

Where indicators are found, SonicWall advises re-imaging hardware or redeploying virtual appliances, changing all user and administrator passwords, and resetting one-time-password tokens, since credentials the appliance handled should be treated as exposed.