On June 22, someone started breaking into corporate networks through the very device those companies had bought to control who gets in. The patch arrived on July 14. For 22 days, the armored door was the open door. And it's not the first time, nor will it be the last: it's the pattern that has been repeating for years with perimeter VPN gateways, whatever the vendor's initials happen to be.
What happened, with dates
On July 14, SonicWall published an advisory for two vulnerabilities in its SMA 1000 series remote access appliances (SMA6210, SMA7210 and the virtual SMA8200v): CVE-2026-15409, a pre-authentication flaw rated CVSS 10.0 that lets anyone on the Internet open a WebSocket tunnel to internal services on the appliance that should only listen on localhost, and CVE-2026-15410 (CVSS 7.2), an injection flaw that turns that access into command execution and escalation to root. Chained together: from the Internet to root on the box that terminates your VPN.
The uncomfortable part came from Volexity three days later, on July 17: a threat actor they track as UTA0533 had been exploiting this chain since June 22, three weeks before a patch existed. This wasn't post-advisory opportunism: it was a zero-day in active use, discovered during an incident response engagement. With root on the appliance they deployed custom malware —KnuckleBall for persistent access, OrangeTail, a Java webshell injected into the SMA's own legitimate processes, and the open-source proxy Suo5— and from there, as Rapid7's MDR team also observed, they extracted credentials, session databases and MFA seeds.
Read that again: MFA seeds. The second factor you deployed so a stolen credential wouldn't be enough, generated from the very appliance that got compromised. CISA added both CVEs to its KEV catalog with a July 17 deadline for US federal agencies. The fixed versions are 12.4.3-03453 and 12.5.0-02835.
It's not SonicWall: it's the model
It would be easy to turn this into a "switch vendors" post. That's not the point. CISA's KEV catalog now lists 17 exploited SonicWall product flaws, yes — but it has also called the roll on Citrix (the infamous Citrix Bleed of 2023), Ivanti Connect Secure (zero-days mass-exploited in January 2024), Fortinet, and Pulse Secure before them. Verizon's 2025 DBIR measured it: exploitation of edge devices and VPNs as the way into a breach grew almost eightfold in one year, from 3% to 22%. Attackers haven't discovered a bad vendor; they've discovered a good class of device.
And this particular case smells professional: Volexity doesn't attribute it to any known group, but the custom malware, the injection into legitimate processes and the patience point more to espionage than to volume ransomware. The reassuring detail —that the actor had little success moving laterally in the observed victims— is also the warning: the next campaign against the same class of box may not be so clumsy once inside.
Why the VPN gateway is the perfect target
Put yourself in the attacker's shoes and the perimeter VPN appliance is almost too good to be true:
- →It's exposed to the Internet by design. You can't hide it behind anything: its job is to listen to strangers. Its entire pre-authentication surface is attackable from anywhere in the world, 24/7.
- →It's a black box you can't instrument. On a compromised server your EDR screams; on a closed appliance there's no agent to install, and the malware —like OrangeTail— lives inside the vendor's own legitimate processes. The visibility you get is whatever the vendor decided to give you.
- →It concentrates the most valuable secrets in the house. Credentials for every remote user, active sessions, MFA seeds. One compromise and the attacker doesn't need phishing: they walk in the front door with legitimate keys.
- →And behind it, total trust. In the classic VPN model, whoever crosses the tunnel "is inside": flat network, broad access, few questions asked. The device is both the wall and the prize.
We run our own network and have been terminating remote access for years, so we say this with first-hand knowledge and without drama: it's not that these devices are badly built. It's that the model asks something structurally dangerous of them —maximum privilege, maximum exposure and minimum observability at the same point— and when it fails, it fails whole.
If you run an SMA 1000 (or one of its cousins): patching is not enough
SonicWall itself says so in its advisory, and it's worth taking seriously because exploitation began three weeks before the patch: updating today does not undo whatever happened since June 22. The order we would apply:
- 1.Patch now to 12.4.3-03453 / 12.5.0-02835. No waiting for a tidy maintenance window: the attacker already used that window.
- 2.Hunt for compromise, don't assume you're clean. Review the appliance logs against the indicators published by Volexity and SonicWall from June 22 onwards. If there's reasonable doubt, treat it as compromised: re-image the appliance, don't "clean" it.
- 3.Rotate what the box was guarding: passwords of the users who traverse it, the appliance's own certificates and secrets, and —this is the step almost nobody takes— the MFA/OTP seeds generated on it. If the attacker took the seeds, your second factor is theirs.
- 4.Reduce surface while you decide the future: restrict which IPs can talk to the portal, take the appliance's management plane off the Internet, and watch the box's outbound traffic — a VPN gateway opening odd connections outwards is a gateway telling you what's happening to it.
The real way out: removing trust, not adding boxes
The industry's answer to each of these incidents is usually to sell you another box. Ours is less comfortable: the problem is implicit trust, and you don't patch that — you dismantle it. That's exactly what's behind the Zero Trust label once you strip away the marketing fog:
- ✓Crossing the tunnel must not mean "being inside". Access per application and per identity, not a whole flat network for typing the right password. If the gateway falls, the attacker inherits a corridor, not the building.
- ✓Less pre-authentication surface exposed. In our remote access designs we use WireGuard with segmented access: with no giant web portal listening to the whole Internet, the attackable surface before authentication shrinks drastically. It's not cryptographic magic; it's having fewer things listening.
- ✓The edge is watched from outside the edge. As a network operator we analyze traffic with NetFlow: you don't ask the appliance whether it's compromised —it would lie to you—, you ask its traffic. Logs and telemetry live outside the box that can be turned against you.
What we are NOT going to tell you
Two honest points before closing. First: we're not telling you to throw out your appliance tomorrow. In some environments that device carries remote access for hundreds of people, and ripping it out overnight creates more risk than it removes; the mitigations above happen today, the architecture changes with a plan. Second: ZTNA alternatives have CVEs too — the invulnerable box does not exist, and anyone selling you one is lying. The reasonable difference isn't "a flawless product"; it's how much surface you expose before authentication, how much the attacker takes when something fails, and how long it takes you to find out. On those three variables, the classic perimeter VPN model loses badly.
And remember who's telling you this: we are not resellers for SonicWall or any ZTNA vendor. We gain nothing from you buying one box or another. We gain something if your remote access stops being the tastiest spot on your network.
In short
An attacker spent 22 days walking in through SonicWall SMA 1000 appliances before a patch existed, taking credentials and MFA seeds with them. It's not an isolated case: it's the latest episode of a series —Citrix, Ivanti, Fortinet, now SonicWall again— that says the same thing every season: the device that concentrates exposure, privilege and opacity will be attacked, and sometimes the attackers will win. Patch today, rotate what the box was guarding, and start designing remote access where getting through the door doesn't hand over the house.
Sources (verified): SonicWall advisory of Jul 14, 2026 and Volexity analysis of Jul 17, 2026 (CVE-2026-15409 CVSS 10.0, CVE-2026-15410 CVSS 7.2, exploitation since Jun 22 by UTA0533, KnuckleBall/OrangeTail/Suo5 malware, KEV deadline Jul 17, 17 SonicWall flaws in KEV) — Help Net Security, SecurityWeek, The Hacker News; theft of credentials, sessions and MFA seeds observed by Rapid7 MDR (via Help Net Security); edge/VPN exploitation from 3% to 22% of breaches — Verizon 2025 DBIR.
Is your remote access still a portal exposed to the whole Internet?
At everyWAN we design remote access with real Zero Trust: identity, per-application segmentation and an edge watched from our own operator network. We'll review how your people get in today and what an attacker would take if your gateway fell tomorrow.
Talk to everyWAN
Microsoft 365
ES 
CAT 
EN