Volexity Says SonicWall Zero-Days Were Exploited for Weeks Before Patches
Summary
Volexity says attackers exploited two SonicWall SMA1000 zero-days for weeks before patches, deploying custom malware and tools. SonicWall issued hotfixes, and CISA added both CVEs to its Known Exploited Vulnerabilities catalog.
Key points
- SonicWall said CVE-2026-15409 and CVE-2026-15410 were exploited in the wild; remote, unauthenticated attackers could target SMA1000 appliances.
- Volexity, which assisted SonicWall's investigation, attributed the exploitation to UTA0533 and believes it began as early as June 22.
- Attackers reportedly deployed KnuckleBall, which injected the OrangeTail webshell and open-source Suo5 proxy into legitimate processes.
- Volexity said root access could expose stored or cached credentials and network traffic; it found evidence suggesting limited success moving laterally.
- SonicWall released hotfixes, and CISA added both CVEs to its Known Exploited Vulnerabilities catalog.
Article Details
- Vulnerability Types
- Remote unauthenticated vulnerabilities
- Severity
- Unknown
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1055 · Process InjectionAfter compromising the appliances, the attackers injected OrangeTail and Suo5 into legitimate processes.T1190 · Exploit Public-Facing ApplicationThreat actors exploited the vulnerabilities to compromise SonicWall SMA1000 appliances remotely and without authentication.T1505.003 · Web ShellThe attackers deployed OrangeTail, described as a tailored Java webshell, on compromised appliances.
CVE
CVE-2026-15409SonicWall released a public advisory for the vulnerabilities on July 14, informing customers that CVE-2026-15409 and CVE-2026-15410 had been exploited in the wild.CVE-2026-15410SonicWall released a public advisory for the vulnerabilities on July 14, informing customers that CVE-2026-15409 and CVE-2026-15410 had been exploited in the wild.
Threat Actors
Malware
KNUCKLEBALLOnce the attackers compromised the targeted SonicWall appliances, they deployed custom malware named KnuckleBall, which injected two other tools into legitimate processes: a tailored Java webshell named OrangeTail, andOrangeTailKnuckleBall, which injected two other tools into legitimate processes: a tailored Java webshell named OrangeTail, and an open source proxy named Suo5.