SonicWall SMA1000 Hacked Third Time; MFA Seeds Stolen in July Outlast September Patches

Enterprise and government organizations running SonicWall SMA1000 VPN appliances faced a third distinct zero-day attack chain in under a year Tuesday, as SonicWall confirmed that two newly discovered vulnerabilities are being actively exploited in the wild — arriving at security teams already dealing with the fallout from a prior wave that left many appliances either unpatched or actively compromised as of August. Resecurity confirmed on August 1 that many devices remained compromised from the July wave and could be repurposed for further intrusions. The new chain requires no credentials to begin, no user interaction to complete, and produces full unauthenticated remote code execution on the 400-plus internet-exposed appliances Shadowserver currently tracks.

Unauthenticated remote code execution on a VPN gateway is not a typical remote-code-execution finding. The SMA1000 aggregates every remote user's credentials, holds active session state, and integrates directly with enterprise directory services — meaning root-level compromise of the appliance is compromise of the authentication system, not just of a single server. Resecurity's full architectural analysis of the SMA1000 VPN concentrator trust model confirms this structural reality.

Two Vulnerabilities, One Attack Chain

SonicWall's Product Security Incident Response Team confirmed active exploitation of both flaws through internal investigation.

CVE-2026-83548 carries a maximum CVSS score of 10.0 and lives in the SMA1000 Appliance WorkPlace interface. It is classified as a server-side request forgery (SSRF) vulnerability and as what the CVSS framework calls an "unintended proxy or intermediary" — a confused deputy that lets the appliance act as a forward proxy on behalf of an unauthenticated attacker. The practical effect: an attacker who sends a crafted request to the WorkPlace interface can cause the appliance to route traffic internally on their behalf, reaching services that were designed to be reachable only from the appliance's own localhost. The SonicWall PSIRT advisory SNWLID-2026-0016 describes the flaw in detail. No login required. No session token. No user interaction. Help Net Security's September 2 coverage confirms no authentication is needed to begin the attack.

CVE-2026-83549 carries a CVSS score of 7.8 and is an OS command injection vulnerability in the Appliance Management Console (AMC). SecurityWeek's September 2 reporting confirms the AMC command injection scope. Under the right conditions, an attacker with administrator-level access to the AMC can pass specially crafted input through the console to the underlying operating system, executing arbitrary commands. Chained after CVE-2026-83548 — using the SSRF flaw to gain unauthorized access to the management plane — an attacker can proceed directly to command execution without ever presenting legitimate credentials at the perimeter.

SonicWall issued patches on September 2, 2026 . Appliances running firmware below version 12.4.3-03526 or 12.5.0-02952 remain vulnerable. Affected models are the SMA1000 6210, 7210, and 8200v — both physical and virtual. SonicWall confirmed that SSL-VPN on SonicWall firewalls and the separate SMA 100 Series product line are not affected by either CVE.

How the Trust Boundary Breaks: What SSRF Means on a VPN Gateway

The SMA1000 is a multi-tier web application. Its internet-facing NGINX front-end terminates external connections and routes authenticated traffic to backend services — CouchDB, a management service called ctrl-service, and Erlang-based administrative interfaces. These backend services are bound exclusively to localhost. They are never intended to communicate directly with external clients. Their security posture assumes that any request reaching them has already been authenticated and authorized at the front-end. Resecurity's full SMA1000 trust-boundary analysis documents this design in full.

CVE-2026-83548 collapses that assumption. The WorkPlace interface's /wsproxy endpoint was designed to proxy WebSocket traffic for legitimate SMA Connect clients. Its implementation accepts attacker-supplied destination host and port parameters without authentication, backend whitelist enforcement, or origin validation. Resecurity's root-cause analysis of the /wsproxy bypass reconstructs the vulnerable code path. By spoofing the client identifiers the endpoint uses as gating signals — a specific User-Agent string and URI parameter — an unauthenticated attacker causes the appliance to open a TCP tunnel to whatever service they name. Naming localhost:8188 reaches the management console. The management console, receiving a request that originates from its own machine, treats it as trusted.

CVE-2026-83549 then converts management-console access into root command execution through improper neutralization of special elements in OS commands passed through the AMC. SecurityWeek's reporting confirms the command injection path to root. This is the same architectural attack pattern that defined the July 2026 SMA1000 zero-day chain — SSRF to collapse the localhost trust boundary, followed by a management-plane vulnerability to reach root.

Douglas McKee, director of vulnerability intelligence at Rapid7, described the July chain's structural dynamics in nearly identical terms: the two bugs together transform a single unauthenticated HTTP request into full root control of a VPN gateway.

What Attackers Take When They Own the Gateway

Root-level compromise of an SMA1000 appliance is more than system access. In July 2026 intrusions documented by Rapid7, attackers extracted high-value credentials and TOTP seeds — active session databases and time-based one-time password (TOTP) MFA seed configurations from compromised appliances. The seed configuration theft is the finding that matters most for defenders planning their response: rotating passwords after a confirmed SMA1000 compromise is necessary but not sufficient if attackers have extracted the seeds that generate valid MFA codes. Those seeds, once stolen, give the attacker the ability to generate valid one-time passwords indefinitely, and stolen TOTP seeds outlast password resets .

Volexity's incident response work on the July wave found that compromised appliances gave attackers access to stored or cached credentials, the ability to capture network traffic in transit, and LDAP traffic flowing unencrypted between the appliance and backend directory services — including plaintext usernames and passwords. SecurityWeek's Volexity coverage documents the plaintext LDAP credential exposure . Resecurity observed active credential harvesting via tcpdump running against TCP port 389 on compromised devices .

The strategic value goes further. From an appliance-level foothold, Rapid7 documented attackers performing NTLM logons against internal domain controllers, sourced from the appliance's own internal IP address, under the appliance's integrated LDAP service account — with no VPN tunnel active on the other end. Rapid7's MDR blog details these VPN-less domain controller authentications . The appliance's inherent trust position inside the enterprise network makes it a launching pad that bypasses the perimeter entirely.

Jeremiah Fowler of Black Hills Information Security, in SC Media's coverage, described the ransomware actor shift : "The recent SonicWall case highlights a disturbing shift in how ransomware groups operate: they have gone from compromising individual endpoints to targeting the network infrastructure and the overall enterprise edge."

INC Ransomware and the 885-Victim Count

The July zero-day wave's dominant threat actor is INC Ransomware, which accelerated its activity in early August and listed multiple new victims on its data leak site in the weeks after SonicWall's July patches became available. Resecurity's report documents INC Ransomware's accelerating August DLS activity . As of August 2, 2026, INC had claimed 885 victims on its leak site — a threat-actor self-reported figure that includes the group's entire operational history, not exclusively SMA1000-linked intrusions. The Hacker News August 2026 coverage of the Resecurity report places the 885-victim figure in context , attributing it to Ransomware.Live tracking data.

Victims documented by Resecurity between July 17 and August 1, 2026 included private sector and government organizations from Australia, the United States, the United Arab Emirates, Colombia, and Switzerland. INC's pressure tactics during extortion included phone calls from an individual identifying himself as "Andrew" and directing victims to helprans[.]com, a domain registered through a Chinese-language registrar in June 2026 before the SonicWall advisory even existed. Resecurity's attacker infrastructure section documents the helprans[.]com registration details.

Resecurity confirmed as of August 1 that many SMA1000 devices from the July wave remained unpatched or actively compromised and could be repurposed for further intrusions. The finding lands with direct relevance today: organizations that did not fully remediate the July wave — and SonicWall explicitly warned that patching alone was not sufficient, recommending log review and reimaging for suspected compromises — may be addressing the September advisory on infrastructure that is already under attacker control. Resecurity's executive summary confirms widespread July-wave remnants as of August 1.

Pre-disclosure exploitation for the July chain began on June 22, 2026, attributed by Volexity to a threat cluster it tracks as UTA0533, 22 days before SonicWall's public advisory. SecurityWeek's Volexity analysis documents the UTA0533 June 22 attribution . That gap allowed attackers to deploy custom malware — ROOTRUN (a setuid ELF binary providing persistent root execution), KNUCKLEBALL (a Python loader injecting malware into the appliance's own JVM), and ORANGETAIL (a custom Java web shell) — before any defender knew a patch was needed. Resecurity's malware analysis section details all three implants. SonicWall's September advisory does not include indicators of compromise for the new wave, leaving defenders without specific forensic signatures to hunt.

The Pattern: Three Waves in Under a Year

The September advisory is the third distinct zero-day attack campaign targeting SMA1000 appliances in under a calendar year. BleepingComputer's September 2 coverage documents the serial SMA1000 zero-day pattern .

In December 2025, SonicWall warned that CVE-2025-40602 — a vulnerability in the Appliance Management Console — was being chained by attackers to gain root privileges on compromised devices. BleepingComputer's December 2025 reporting covered the CVE-2025-40602 zero-day .

In July 2026, CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410 (CVSS 7.2) emerged as actively exploited zero-days, with exploitation beginning June 22 before any patch existed. The SonicWall PSIRT advisory SNWLID-2026-0008 documented both July CVEs. CISA added both to its Known Exploited Vulnerabilities catalog on the same day as the advisory and ordered federal civilian agencies to patch under Binding Operational Directive 26-04, with a remediation deadline of July 17 — three days after disclosure. The CISA KEV catalog entry carried the July 17 deadline. CISA described SMA1000 as "a frequent attack vector for malicious cyber actors" posing "significant risks to the federal enterprise." BleepingComputer's reporting on the CISA ransomware KEV update confirmed ransomware gang exploitation. CISA's KEV catalog now lists 17 total SonicWall product vulnerabilities as confirmed exploited.

Now in September, the third chain has arrived — same appliance class, same architectural attack pattern, new CVEs.

The three affected models — SMA1000 6210, 7210, and 8200v — serve as the VPN gateway for medium and large enterprises, government agencies, and managed security service providers. By design, they sit directly on the internet, process credentials for remote users, and broker access to internal applications, directory services, file shares, and management interfaces.

Shadowserver currently tracks more than 400 SMA1000 appliances directly exposed on the internet, though some may already have been patched. BleepingComputer's September 2 coverage reports the Shadowserver 400-plus figure . The number represents not just 400-plus potential targets but 400-plus credential concentrators whose compromise would propagate access to every downstream system they protect.

SonicWall's advisory identifies patching as urgent, but given the pattern established by the July wave — where even patched appliances required additional steps to be fully remediated, and where Resecurity confirmed many remained compromised weeks later — patching alone should be treated as the minimum first step, not the complete response.

Organizations running SMA1000 6210, 7210, or 8200v appliances should:

Apply the relevant hotfix immediately. For the 12.4.3 firmware branch, upgrade to version 12.4.3-03526 or later. For the 12.5.0 branch, upgrade to 12.5.0-02952 or later through MySonicWall.

Audit for compromise from both waves. Given that no indicators of compromise have been published for the September chain, the most actionable forensic target right now is the July wave's published IoCs. Check appliance logs for /wsproxy requests with external source IPs and loopback destination parameters. Review extraweb_access.log for WebSocket 101 responses to /wsproxy with host=0.0.0.0 or 127.0.0.1. Look for unexpected setuid binaries, modifications to /etc/init.d/workplace, and NGINX Unit configuration changes in /var/lib/unit/conf.json. Resecurity's threat hunting guidance covers all of these forensic targets. The presence of July-wave implants on a device means that September's hotfix is being applied to already-compromised infrastructure.

Reimage if compromise is suspected. SonicWall advises full reimage and redeployment rather than attempting to clean a suspected compromise in place. Factory-reset, reflash with patched firmware, and restore configuration from a known-good backup that predates the vulnerable firmware branches. Resecurity's full appliance rebuild guidance specifies the recommended rebuild sequence.

Reset all credentials — but understand the limits. Rotate all administrator passwords and regenerate TOTP tokens. Critical caveat: if attackers extracted TOTP seed configurations during a prior compromise, generating new tokens from the same seeds does not protect against an adversary who holds those seeds. Verify that TOTP configuration has been rebuilt from scratch, not merely refreshed. Both Rapid7's MDR blog and Resecurity confirm this credential rotation distinction .

Monitor for CISA KEV addition. CVE-2026-83548 and CVE-2026-83549 had not been added to CISA's Known Exploited Vulnerabilities catalog as of September 2, 2026. Addition would impose a three-day remediation deadline on federal civilian agencies under BOD 26-04. Given the pattern of the July wave, addition is likely.

Frequently Asked Questions

Does patching the September zero-days fix the July zero-day exposure too?

No. The July and September zero-day chains involve different CVEs and different hotfix releases. Applying the September hotfix (12.4.3-03526 or 12.5.0-02952) does not retroactively patch the July vulnerabilities (CVE-2026-15409 and CVE-2026-15410), which required earlier hotfix versions released in July. Organizations must confirm separately that the July flaws were patched and, critically, that the appliance was not already compromised before that patching occurred. Resecurity confirmed in August that many SMA1000 appliances remained unpatched or compromised from the July wave — meaning some organizations may be addressing September's advisory on infrastructure already under attacker control .

Do these vulnerabilities affect SonicWall firewalls or SMA 100 Series appliances?

No. SonicWall confirmed in its advisory that CVE-2026-83548 and CVE-2026-83549 affect only the SMA1000 6210, 7210, and 8200v models. SSL-VPN functionality on SonicWall firewalls and the separate SMA 100 Series product line are unaffected by both September CVEs. The SonicWall PSIRT advisory SNWLID-2026-0016 confirms this scope explicitly.

Why does rotating passwords not fully protect a compromised SMA1000?

Attackers who achieved root access to an SMA1000 appliance during the July wave extracted TOTP MFA seed configurations — the underlying secrets from which time-based one-time passwords are generated. Rapid7's MDR blog documents the July-wave TOTP seed extraction . A seed is not a password. Changing a user's password does not change or invalidate the TOTP seed. An attacker holding the seed can continue generating valid one-time authentication codes indefinitely. Full protection requires that TOTP configuration be rebuilt from scratch on a clean appliance, not merely that passwords be rotated. Both Resecurity and ComplianceHub.wiki's TOTP analysis confirm this rebuild requirement .

What is SSRF and why is a CVSS 10.0 SSRF on a VPN gateway particularly dangerous?

Server-side request forgery (SSRF) is a vulnerability in which an attacker tricks a server into making requests to locations of the attacker's choosing — typically internal resources the server can reach but the attacker cannot directly. On an ordinary web application, SSRF is serious but bounded. On a VPN gateway like the SMA1000, SSRF is categorically more dangerous because the appliance's backend services — the management console, the administrative interfaces, the configuration database — all trust traffic that appears to originate from localhost. A pre-authentication SSRF on the WorkPlace interface, such as CVE-2026-83548, gives an unauthenticated internet attacker a bridge into those internally trusted services with no credentials required. Resecurity's architectural analysis and Help Net Security's September 2 coverage both document this elevated SSRF risk on VPN gateways.