A pair of vulnerabilities in SonicWall’s Secure Mobile Access (SMA) 1000 series appliances has given attackers a way to seize full root control of internet-facing VPN gateways without ever needing a password, an active session, or any interaction from a victim. According to a report from threat intelligence firm Resecurity, the chain has already been weaponized in the wild, with the INC Ransomware group identified as the primary operator behind the campaign.

A Two-Step Path From Web Request to Root

The attack chain combines two distinct flaws. The first, tracked as CVE-2026-15409, is a maximum-severity, pre-authentication bypass in SonicWall’s “wsproxy” component that lets an outsider open a WebSocket tunnel into internal services that were never meant to be reachable from the public internet. Attackers use this tunnel to reach local-only backends, including a CouchDB instance and an internal control service, simply by sending a crafted request with spoofed client details.

The second flaw, CVE-2026-15410, is a path-traversal bug in the appliance’s “removehotfix” process. Once an attacker has used the wsproxy bypass to get a foothold, this second bug lets them plant and execute a script with full system privileges, completing the jump from a low-privilege network request to root access on the device.

Resecurity says exploitation activity was already underway by at least June 22, roughly a month before SonicWall shipped patches in July, leaving organizations with little warning before the flaws were being actively abused.

What Happens After Root Access

Because SMA appliances sit at the boundary between the open internet and an organization’s internal network, a compromised device is a high-value foothold. Resecurity’s analysis found that once attackers gained root, they installed a durable backdoor, a covert traffic-forwarding tool, and a memory-resident web shell, then modified startup scripts and routing configuration so the implants would survive a reboot.

Investigators also observed the attackers capturing unencrypted LDAP traffic passing through the device, a technique that can expose directory-service credentials well beyond the VPN appliance itself. Because the gateway is inherently trusted by connected users and systems, malicious traffic generated this way can blend into normal remote-access activity, giving intruders time to map the network, harvest additional credentials, and stage a ransomware deployment before being noticed.

Which Devices Are Affected

The vulnerable line is the SMA 1000 series, including the SMA 6210, SMA 7210, and SMA 8200v models, along with associated vCMS deployments. SonicWall’s separate firewall SSL VPN product and the SMA 100 series are not affected by this particular chain.

Recommended Response

SonicWall has released firmware updates that close both holes, and Resecurity stresses there is no viable workaround short of patching. Organizations that had an exposed, vulnerable appliance during the exploitation window are advised to treat it as potentially compromised rather than assume patching alone resolves the risk. Recommended steps include:

• Upgrade affected appliances to firmware 12.4.3-03453 or later, or 12.5.0-02835 or later
• Preserve logs before making any changes, and review access records for unusual wsproxy traffic, unexpected WebSocket upgrade responses, or abnormal client-agent strings
• Inspect temporary directories, startup files, and routing configuration for signs of planted scripts or unauthorized setuid binaries
• If compromise is confirmed, factory-reset the appliance, rebuild it on patched firmware, and restore only a known-good configuration predating the exposure window
• Rotate administrator, directory-service, and end-user credentials handled by the device, along with any certificates, API keys, and MFA secrets
• Move directory traffic to encrypted protocols such as LDAPS or StartTLS, and restrict management interfaces to trusted network ranges

The episode fits a broader pattern of ransomware crews targeting internet-facing VPN and remote-access appliances as a fast route into enterprise networks. Security teams running SonicWall SMA 1000 hardware should treat patching, a full compromise assessment, and credential rotation as a single, urgent package rather than sequential tasks.