CVE-2026-15409, CVE-2026-15410: SonicWall SMA VPN — Root Access, Credential Theft (June 2026)

CVE-2026-15409, CVE-2026-15410 — SonicWall SMA 1000 VPN

Two critical vulnerabilities, CVE-2026-15409 and CVE-2026-15410, impact SonicWall SMA 1000 VPN appliances. Both allow unauthenticated attackers to gain root access, install persistent malware, and capture authentication credentials. Exploitation in the wild began as early as June 22, 2026. These flaws are being used to compromise secure remote access infrastructure in enterprise and government environments.

Attack Vector

Attackers exploited the zero-days to remotely execute code as root on vulnerable SMA appliances. Post-compromise, they deployed custom malware (including ROOTRUN, KNUCKLEBALL, Suo5, and ORANGETAIL), established persistence, and attempted to intercept VPN credentials and network traffic. Indicators of compromise include unexpected outbound connections from SMA devices, unauthorized files in /var/tmp and /tmp, altered routes in /var/lib/unit/conf.json, and the presence of setuid binaries. The attack chain enables stealthy, long-term access and lateral movement within affected networks.

Who Is at Risk

All organizations running SonicWall SMA 1000 series VPN appliances are at immediate risk, including medium-to-large businesses, government agencies, and managed security providers. No specific version numbers are provided, but all unpatched SMA 1000 deployments should be considered vulnerable. Confirmed victims span multiple sectors globally.

Patch & Mitigate

• Patch: Apply SonicWall's official security update for SMA 1000 series immediately. Check vendor advisories for the latest fixed versions.
• Workaround: None effective; device isolation may limit exposure until patched.
• Detect: Audit for unexpected outbound connections from SMA appliances, new or suspicious files in /var/tmp and /tmp, changes to /var/lib/unit/conf.json, and presence of malware files (ROOTRUN, KNUCKLEBALL, Suo5, ORANGETAIL).

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploited internet-facing VPN appliances to gain entry.
• TA0005 — Defense Evasion: Custom malware and setuid binaries enabled stealth and persistence.
• TA0008 — Lateral Movement: Credential theft and traffic capture facilitated attempts to move within victim networks.

Source: https://www.helpnetsecurity.com/2026/07/21/sonicwall-sma-zero-days-exploited-cve-2026-15409-cve-2026-15410/