--- title: SonicWall SMA1000 flaws exploited as zero-days to push... description: Two SonicWall SMA1000 vulnerabilities (CVE-2026-15409, a critical SSRF flaw, and CVE-2026-15410, a command injection flaw) were chained together in zero-day... canonical: https://daily.dev/posts/sonicwall-sma1000-flaws-exploited-as-zero-days-to-push-custom-malware-casacswi1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: SonicWall SMA1000 flaws exploited as zero-days to push custom malware | daily.dev og:description: Two SonicWall SMA1000 vulnerabilities (CVE-2026-15409, a critical SSRF flaw, and CVE-2026-15410, a command injection flaw) were chained together in zero-day... og:url: https://daily.dev/posts/sonicwall-sma1000-flaws-exploited-as-zero-days-to-push-custom-malware-casacswi1 og:image: https://api.daily.dev/og/posts/CaSAcSwI1.png og:image:alt: SonicWall SMA1000 flaws exploited as zero-days to push custom malware og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # SonicWall SMA1000 flaws exploited as zero-days to push custom malware **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary Two SonicWall SMA1000 vulnerabilities (CVE-2026-15409, a critical SSRF flaw, and CVE-2026-15410, a command injection flaw) were chained together in zero-day attacks starting June 22, weeks before public disclosure. Incident response firm Volexity, which assisted SonicWall in the investigation, detailed how threat actor UTA0533 exploited the SSRF to access internal services including CouchDB, then used command injection to gain root access. With root access, attackers deployed a custom malware dropper (KNUCKLEBALL) that installed two Java-based malware families: Sou5 (a reverse proxy for covert tunneling) and ORANGETAIL (a webshell for executing encrypted payloads). A privilege-escalation tool called ROOTRUN was also installed. SonicWall has released patches in versions 12.4.3-03453 and 12.5.0-02835. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs](https://daily.dev/posts/cisa-sonicwall-sma1000-flaws-now-exploited-by-ransomware-gangs-x9e9rvfsr) · BleepingComputer · 0 upvotes · 0 comments - [Another bad week for SonicWall as SMA 1000 0-day exploited](https://daily.dev/posts/another-bad-week-for-sonicwall-as-sma-1000-0-day-exploited-vbcm0llpl) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#malware](https://daily.dev/tags/malware), [#vulnerability](https://daily.dev/tags/vulnerability), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/sonicwall-sma1000-flaws-exploited-as-zero-days-to-push-custom-malware-casacswi1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"SonicWall SMA1000 flaws exploited as zero-days to push custom malware","url":"https://daily.dev/posts/sonicwall-sma1000-flaws-exploited-as-zero-days-to-push-custom-malware-casacswi1","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/sonicwall-sma1000-flaws-exploited-as-zero-days-to-push-custom-malware-casacswi1"},"datePublished":"2026-07-20T22:23:42.637Z","dateModified":"2026-07-20T22:44:32.191Z","description":"Two SonicWall SMA1000 vulnerabilities (CVE-2026-15409, a critical SSRF flaw, and CVE-2026-15410, a command injection flaw) were chained together in zero-day...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e22116d0c30cd492a5b7d91e7fa5ed85?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e22116d0c30cd492a5b7d91e7fa5ed85?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/sonicwall-sma1000-flaws-exploited-as-zero-days-to-push-custom-malware-casacswi1","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,malware,vulnerability,zero-day","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"SonicWall SMA1000 flaws exploited as zero-days to push custom malware"}]} ```