SonicWall SMA1000 – Zero-Days at the Edge, Stolen MFA Seeds, and a Password Called admin:admin

Two SonicWall SMA1000 flaws — an unauthenticated SSRF rated a perfect 10.0 (CVE-2026-15409) and a path-traversal-to-root bug (CVE-2026-15410) — were exploited as zero-days from at least 22 June, three weeks before the 14 July patches. We walk through the tradecraft of actor UTA0533: in-memory Java implants injected into legitimate appliance processes, a webshell that plays dead for scanners, logs symlinked to /dev/null — plus stolen credentials, session databases and TOTP MFA seeds, and lateral movement into domain controllers from the appliance's own service account. Also covered: CISA's KEV listing and 3-day federal deadline under BOD 26-04, an INC ransomware affiliate reusing the chain within days, and the shipped admin:admin database and shared vendor-default identifier that amounted to a backdoor by default. Four actions: hunt (don't just patch), treat edge appliances as forensic crown jewels, keep MFA seeds off the gateway, and alert on domain logons from appliance IPs with no VPN session. No China attribution — treat any such headlines as unverified.

Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: Volexity "Proxying to Compromise" (17 Jul), Rapid7 blog (15 Jul), SonicWall advisory SNWLID-2026-0008, CISA KEV (14 Jul), Cybersecurity Dive (20 Jul), BleepingComputer.