CVE-2026-15409: SonicWall SMA1000 zero-day tunnels attackers to internal services

What it is

The SMA1000 WorkPlace portal has a WebSocket endpoint, /wsproxy, that tunnels a logged-in user’s traffic to internal hosts. On affected hotfixes, a request with the user agent SMA Connect Agent and a bmID value starting with -3389 gets a tunnel without any session, and can point it at 0.0.0.0 or localhost (Volexity). That exposes services meant to be reachable only from the appliance itself:

• CouchDB on port 1050, which ships with the credentials admin:admin.
• The control service (ctrl-service) on port 8188, which runs system operations as root.

Attackers chained this with CVE-2026-15410. Through CouchDB they wrote a script that read the appliance’s hardware UUID, which is the control service’s password. They then called the control service’s hotfix-removal function with a path-traversal name like ../../../../../tmp/1234.sh, which ran their script as root. Volexity also found that many physical appliances share the same default UUID, which on its own would unlock the control service.

With root, the actor Volexity calls UTA0533 planted custom implants that survive reboots, sniffed LDAP traffic for domain passwords, and used the appliance to authenticate to internal systems. Rapid7 saw theft of credentials, session databases and TOTP MFA seeds, and logons to domain controllers. Resecurity says INC ransomware has since become the main actor using the chain, and CISA has flagged both CVEs as used in ransomware campaigns.

Am I affected?

You’re affected if you run an SMA1000 6210, 7210 or 8200v on any of these platform hotfixes:

• 12.4.3-03245, 12.4.3-03387 or 12.4.3-03434
• 12.5.0-02283, 12.5.0-02624 or 12.5.0-02800

The attack needs only network access to the WorkPlace interface’s /wsproxy endpoint. No credentials and no special configuration are required.

SSL-VPN on SonicWall firewalls and the SMA 100 Series are not affected.

What to do

1. Install the newest hotfix: 12.4.3-03670 or 12.5.0-03082 (or later) from MySonicWall. July’s 12.4.3-03453 and 12.5.0-02835 fix this CVE but are vulnerable to CVE-2026-83548, a second WorkPlace SSRF exploited in September, and to CVE-2026-102255, fixed in October. There is no workaround.

2. Check for compromise, whatever your patch date. Exploitation started at least three weeks before the advisory, and a patched appliance can still carry implants. Use SonicWall’s log checks and Volexity’s file checks below.

3. If you find any indicator, SonicWall says to:

• Re-image hardware appliances, or redeploy virtual ones. Don’t clean in place: the implants patch running Java processes and edit startup scripts.
• Change all user and administrator passwords.
• Reset every user’s TOTP token. Attackers stole the MFA seeds, so old tokens are no longer a second factor.

Also rotate the LDAP or AD service account the appliance uses. Rapid7 saw attackers log on to domain controllers with it, and Volexity saw LDAP traffic captured. Review Windows logons from the appliance’s internal IP (below) and treat matches as a network intrusion. Resecurity reports INC ransomware victims also got calls and emails from “helpers” offering to resolve the incident. Route those to your incident response team and law enforcement.

Detection

SonicWall’s indicators (from the advisory):

• In /var/log/aventail/extraweb_access.log: requests to /__api__/login or /__api__/logout with status 200. These paths don’t exist on a clean appliance.
• In the same log: requests to /wsproxy with status 101 and suspicious host values, such as 0.0.0.0, localhost or ::ffff:127.0.0.1, often with bmID=-3389..., serviceType=SSH and port=1050 or port=8188. Rapid7 also saw serviceType=TELNET.
• In /var/log/aventail/ctrl-service.log: hotfix rollbacks with path-traversal names, such as running hotfix removal for:../../../../../tmp/1234.sh.
• In /var/lib/unit/conf.json: routes for /__api__/login or /__api__/logout. Volexity found them proxied to http://127.0.0.1:8085.

On the appliance (Volexity):

• WebSocket connections to host = 0.0.0.0 and port =1050 (or 8188) in /var/log/aventail/access_servers.log.
• Unexpected setuid binaries. Run find / -perm -4000 and compare with Volexity’s list of legitimate ones. /usr/bin/xzfind is the attacker’s.
• python3 /usr/lib/python3.11/site-packages/deploy_new.py added to /etc/init.d/workplace.
• Unexpected files in /tmp and /var/tmp, especially owned by the couchdb user, and tcpdump capture files.
• Requests to /workplace/error.jsp or /workplace/dialogs/errorDialog.jsp with the fake Mozilla/6.0 ... Chrome/149.0.0.1 user agent.

In your network (Rapid7):

• Windows event 4624, logon type 3, from the appliance’s internal IP to domain controllers or other servers, with no matching VPN session and workstation names like kali or DESKTOP-....
• Access to /tmp/temp.db* on the appliance, which holds session data.
• Probes for /auth1.html, /.env and /api/sonicos/is-sslvpn-enabled from the IP ranges listed above.