SonicWall SMA1000 Zero-Day RCE Chain — CVE-2026-15409 + CVE-2026-15410

SonicWall confirmed on 2026-07-14 that two SMA 1000 Series flaws are being exploited in tandem as zero-days. CVE-2026-15409 (CVSS 10.0) is an unauthenticated server-side request forgery (SSRF) in the SMA1000 Appliance Work Place interface; CVE-2026-15410 (CVSS 7.2) is a post-authentication OS command injection in the Appliance Management Console (AMC). Chained, an unauthenticated remote attacker reaches the AMC via the SSRF and injects commands, achieving arbitrary OS command execution with administrative privileges on the appliance. CISA added both to the KEV catalog on 2026-07-14 with a BOD 26-04 federal remediation deadline of 2026-07-17. Fixed builds are v12.4.3-03453 and v12.5.0-02835 (hotfix via SonicWall Support).

The SMA1000 is an SSL-VPN concentrator: a compromise hands the attacker a trusted network position, active VPN sessions, and cached/relayed credentials. The appliance itself does not run a Falcon sensor, so this pack hunts the post-exploitation blast radius on Falcon-covered internal hosts — the appliance acting as a network pivot, first-seen remote logons from the VPN segment, credential access, discovery, ingress tooling, tunneling, and outbound C2 from hosts reachable through the appliance.

As of publication, neither SonicWall PSIRT nor Volexity (Sean Koessel, Steven Adair — credited reporters) has released public atomic IOCs (attacker IPs, webshell hashes). SonicWall is distributing a customer-run IOC script and KB. This pack is therefore behavior-led; the atomic IOC blocks ship as placeholders to fill from the SonicWall KB / your incident.

Defender priority: Treat every internet-exposed SMA1000 as potentially compromised until the hotfix is applied and logs are reviewed. Patching alone does not evict an attacker who already has admin. Hotfix → run SonicWall's IOC script → rotate all appliance admin + VPN + reachable-domain credentials → then hunt the internal segment with Q1–Q8 below.

Intel gap: No public atomic IOCs at publication. Reporters withheld attacker infrastructure and webshell hashes; SonicWall's detail lives in a customer KB + IOC script. Detection here is behavior-first; enrich the IOC appendix from the SonicWall KB and your own appliance logs.

The appliance is off-sensor, so hunt the seam where the attacker steps from the appliance into Falcon-covered infrastructure. Every hypothesis below assumes you can supply the appliance's internal interface IP and the VPN client subnet.

Attack chain

Hypotheses (fidelity-ordered)

1. H1 (high): Post-compromise the appliance initiates connections to internal hosts it never normally talks to.
2. H2 (high): Credential-dump tradecraft (comsvcs MiniDump / procdump on lsass) appears on a host reachable from the VPN segment.
3. H3 (medium): A first-seen admin remote logon arrives from the VPN client subnet to a server.
4. H4 (medium): Tunneling/proxy binaries run on internal hosts to relay the attacker deeper.
5. H5 (medium): A single host emits a tight discovery burst (whoami/nltest/net) consistent with hands-on-keyboard.
6. H6 (medium): LOLBin ingress-tool-transfer downloads land on reachable hosts.
7. H7 (medium): Remote service/scheduled-task creation follows an inbound pivot connection.
8. H8 (low): Rare-destination outbound beaconing from the reachable subnet indicates staged C2.

No vendor-published atomic IOCs exist at publication. The table below is the analyst-supplied and behavioral indicator set that drives the hunt; fill the atomic rows from the SonicWall KB / IOC-script output and your incident.

The highest-value evidence for steps 1–2 lives on the appliance, not in Falcon. Run these directly:

• SonicWall IOC script: obtain and run the customer IOC script from SonicWall Support / KB on every SMA1000. This is the authoritative check for on-appliance compromise.
• AMC audit review: inspect Appliance Management Console access logs for unexpected admin logins, config exports, or new local admin accounts around the exposure window.
• Work Place / proxy logs: look for anomalous internal or loopback request targets originating from the appliance (SSRF fingerprints), and for unusual outbound requests from the management interface.
• Firmware version audit: confirm every appliance is at v12.4.3-03453 / v12.5.0-02835 or later; treat anything below as vulnerable and potentially breached.
• VPN session review: enumerate active/recent VPN sessions and OTP bindings; look for sessions from unexpected geographies or impossible-travel patterns.

Every query needs one analyst input: replace REPLACE_WITH_SMA1000_APPLIANCE_IP / REPLACE_WITH_VPN_CLIENT_SUBNET with your values before running. Start with Q1 and Q3 — highest fidelity.

// HUNT: SMA1000 appliance acting as network pivot into the LAN
// MITRE: T1210, T1090 | CONF: high  FP: med  COST: low | REQUIRES: NetworkConnectIP4
// FALSE POSITIVES: appliance auth callbacks to RADIUS/LDAP/DC backends
// TUNING: exclude known backend hosts and ports 389/636/1812/1813
#event_simpleName=/NetworkConnectIP4/
| RemoteAddressIP4="REPLACE_WITH_SMA1000_APPLIANCE_IP"
| RemotePort!="389" | RemotePort!="636" | RemotePort!="1812"
| groupBy([ComputerName, aid, LocalPort, RemotePort], function=count(as=conns))
| table([ComputerName, aid, LocalPort, RemotePort, conns], limit=200)

// HUNT: remote logons originating from the VPN client subnet
// MITRE: T1021, T1078 | CONF: med  FP: med  COST: low | REQUIRES: UserLogon
// FALSE POSITIVES: normal remote-worker VPN logons
// TUNING: keep LogonType 3/10; exclude service accounts; focus admin group members
#event_simpleName=/UserLogon/
| LogonType="3" | RemoteAddressIP4="REPLACE_WITH_VPN_CLIENT_SUBNET"
| groupBy([UserName, ComputerName, LogonType], function=count(as=logons))
| table([UserName, ComputerName, LogonType, RemoteAddressIP4, logons], limit=200)

// HUNT: LSASS memory dump via comsvcs/procdump/rundll32
// MITRE: T1003.001 | CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: sanctioned DFIR memory capture — confirm operator + change ticket
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/(comsvcs\.dll.{0,40}MiniDump|procdump.{0,20}lsass|rundll32.{0,40}MiniDump)/i
| table([ComputerName, aid, UserName, FileName, ParentBaseFileName, CommandLine], limit=200)

// HUNT: service / scheduled-task creation (lateral foothold)
// MITRE: T1543.003, T1053.005, T1569.002 | CONF: med  FP: med  COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: SCCM/Intune/RMM software deployment
// TUNING: exclude deployment service accounts and known RMM ParentBaseFileName
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(sc|schtasks|psexesvc|paexec)(\.exe)?$/i
| CommandLine=/(create|\/tn |binpath|start= auto)/i
| table([ComputerName, aid, UserName, FileName, ParentBaseFileName, CommandLine], limit=200)

// HUNT: discovery command burst from a single host
// MITRE: T1087, T1082, T1018, T1016 | CONF: med  FP: med  COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: logon scripts, asset-inventory agents
// TUNING: alert when distinct recon binaries on one host in 10m is high; exclude inventory service accounts
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(whoami|nltest|net1?|systeminfo|ipconfig|arp|route|quser|tasklist|nltestrk)(\.exe)?$/i
| groupBy([ComputerName, aid], function=count(field=FileName, as=recon, distinct=true))
| table([ComputerName, aid, recon], limit=200)

// HUNT: LOLBin downloaders pulling attacker tooling
// MITRE: T1105 | CONF: med  FP: med  COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: legitimate admin/update scripts
// TUNING: require external URL; exclude patch-management ParentBaseFileName
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/(certutil.{0,30}urlcache|bitsadmin.{0,30}transfer|curl\s.{0,40}http|Invoke-WebRequest|DownloadString|DownloadFile|wget\s.{0,40}http)/i
| table([ComputerName, aid, UserName, FileName, ParentBaseFileName, CommandLine], limit=200)

// HUNT: rare external destinations from the reachable segment
// MITRE: T1071, T1571 | CONF: med  FP: high  COST: med | REQUIRES: NetworkConnectIP4
// FALSE POSITIVES: CDNs, SaaS, software updaters
// TUNING: allowlist corporate egress ranges/known SaaS; keep non-browser ContextBaseFileName
#event_simpleName=/NetworkConnectIP4/
| ConnectionDirection="0"
| RemotePort=/^(443|8443|53|4443|8080|1194|1080)$/
| groupBy([RemoteAddressIP4, RemotePort, ContextBaseFileName], function=count(field=ComputerName, as=hosts, distinct=true))
| table([RemoteAddressIP4, RemotePort, ContextBaseFileName, hosts], limit=200)

// HUNT: reverse-tunnel / proxy tooling
// MITRE: T1572, T1090 | CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: sanctioned admin tunnels (plink for jump hosts) — confirm operator
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(ngrok|plink|chisel|frpc|frps|gost|ssf|nps|netsh)(\.exe)?$/i
| table([ComputerName, aid, UserName, FileName, ParentBaseFileName, CommandLine], limit=200)

Q2, Q5, Q6, Q7 stay investigate-only hunt/scheduled searches — too environment-dependent for a low-FP IOA without local tuning.

No vendor atomic IOCs at publication — the CSV ships with placeholders. Fill from the SonicWall KB / IOC-script output, then bulk-import.

type,value,action,severity,expiration,description,tags
ipv4,REPLACE_WITH_ATTACKER_IP,detect,critical,2027-01-15,SMA1000 exploit source,campaign:SMA1000-RCE
sha256,REPLACE_WITH_WEBSHELL_SHA256,prevent,critical,2027-01-15,SMA1000 dropped tooling,campaign:SMA1000-RCE
domain,REPLACE_WITH_C2,detect,high,2026-10-15,SMA1000 post-exploit C2,campaign:SMA1000-RCE

- Appliance-IP as source of inbound LAN connections (Q1)
- LSASS MiniDump via comsvcs/procdump/rundll32 (Q3)
- Reverse-tunnel binaries: ngrok/chisel/frpc/gost/ssf (Q8)
- Discovery burst: many distinct recon LOLBins on one host (Q5)
- First-seen admin remote logon from VPN subnet (Q2)

CVE-2026-15409  SSRF  CVSS 10.0  SMA1000 Work Place
CVE-2026-15410  OS command injection  CVSS 7.2  AMC
Vulnerable: SMA 1000 Series below v12.4.3-03453 / v12.5.0-02835
Fixed: v12.4.3-03453 , v12.5.0-02835

[ ] Inventory all SMA 1000 Series appliances + firmware build
[ ] Confirm build >= v12.4.3-03453 or v12.5.0-02835
[ ] Run SonicWall customer IOC script on each appliance
[ ] Confirm AMC not reachable from the internet
[ ] Rotate appliance admin + VPN + reachable-domain creds
[ ] Reset OTP/MFA seeds; review active VPN sessions

1 · Restrict SMA1000 management + egress (NGFW policy, pseudo-config)

# Allow AMC (mgmt console) only from the admin jump subnet
access-rule from ADMIN_JUMP to SMA1000_MGMT service HTTPS action allow
access-rule from ANY        to SMA1000_MGMT service HTTPS action deny log
# Constrain appliance egress to known auth backends only (kills SSRF pivot)
access-rule from SMA1000 to AUTH_BACKENDS service LDAP,LDAPS,RADIUS action allow
access-rule from SMA1000 to ANY service ANY action deny log

2 · Enable LSASS protection + Credential Guard on reachable Windows servers (PowerShell)

# RunAsPPL — protect LSASS from userland dumping
New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" `
  -Name RunAsPPL -Value 1 -PropertyType DWORD -Force
# Credential Guard via VBS (requires reboot; pilot on a ring first)
New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard" `
  -Name EnableVirtualizationBasedSecurity -Value 1 -PropertyType DWORD -Force
New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" `
  -Name LsaCfgFlags -Value 1 -PropertyType DWORD -Force

3 · ASR rule — block credential theft from LSASS (GPO / PowerShell)

# Defender ASR: Block credential stealing from lsass.exe
Add-MpPreference -AttackSurfaceReductionRules_Ids `
  9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 `
  -AttackSurfaceReductionRules_Actions Enabled

4 · Post-hardening CQL spot-check

# Re-run Q3 after RunAsPPL/ASR rollout — expect zero successful lsass dumps
# Any hit post-deployment = tampering or a gap; escalate immediately.

Validation: the on-appliance exploitation itself (steps 1–2) is a permanent Falcon gap — cover it with appliance syslog + the SonicWall IOC script (§7). Falcon coverage is strongest on the credential-access and tunneling stages; the pivot/logon queries are high-value but require the analyst to supply the appliance IP and VPN subnet and to baseline first.