Volexity researchers have uncovered an attack campaign that exploited two SonicWall SMA 1000 vulnerabilities as zero-days starting June 22, weeks ahead of public disclosure. The two flaws, CVE-2026-15409 and CVE-2026-15410 — an SSRF and a code injection bug respectively — handed attackers root-level control over the VPN appliances.
The SSRF hole let intruders open a tunnel from the internet at large to services that should only be reachable from within the device itself. Among those services was a bundled CouchDB instance that ships with the appliance using admin:admin as its default credentials. Because the SSRF tunnel placed CouchDB within reach, attackers wrote and executed a script that read the appliance’s hardware ID, granting access to a system control endpoint open to command injection and privilege escalation.
With root access secured, the group deployed a privilege-escalation utility called ROOTRUN and a Python-based loader named KNUCKLEBALL. The loader slipped two hidden Java components into an already-running SonicWall process: Suo5, an open-source proxy tool for tunneling traffic, and ORANGETAIL, a custom web shell that only activates when it receives requests with a slightly unusual browser identification string.
SonicWall recommends that organizations re-image compromised appliances, rotate all credentials, and reset TOTP tokens even after applying fixes. Volexity made YARA rules and compromise indicators available to help defenders spot the attack.
