CVSS 10 SonicWall VPN Flaw Now Weaponized by INC Ransomware

Two CVEs. One unauthenticated root shell. Three weeks of zero-day exploitation before the vendor advisory dropped. If your organization runs a SonicWall SMA 1000 series appliance and it has not been patched to the July 14 firmware, treat it as compromised and work backwards from there.

The INC ransomware group — which has claimed 885 victims across its lifetime — has emerged as the dominant operator turning these flaws into network intrusions, and they have brought a toolkit that reflects genuine operational discipline. Patches are available. The window for quiet exploitation is not.

Two Flaws That Chain Into Root

CVE-2026-15409 (CVSS 10.0) is a server-side request forgery in the SMA 1000 WorkPlace interface. The /wsproxy endpoint, designed to proxy WebSocket traffic, accepts a destination host and port from any unauthenticated caller and opens a tunnel wherever it is told — including loopback-only services that were never meant to be internet-reachable. Attackers point it at the Erlang runtime listening on port 1050 and gain initial code execution on the device. No login. No prior foothold.

CVE-2026-15410 (CVSS 7.2) takes it the rest of the way. A path-traversal bug in the appliance's remove_hotfix workflow lets an attacker deliver a malicious payload via the hotfix parameter. Reached through CVE-2026-15409 by tunneling to the Appliance Management Console service on port 8188, the result is arbitrary OS command execution as root. Rapid7's MDR team discovered both flaws while responding to active customer intrusions — and when they published their findings in mid-July, exploitation had already been underway since at least June 22.

Who INC Is and What They Do After Getting In

INC is not opportunistic. The group has been operating since at least 2023, publishes a structured leak site, and makes direct phone contact with victims as part of its extortion playbook — callers identifying themselves as "a group of hackers" have reached out via helprans[.]com (registered June 2, 2026) and a West Virginia phone number. Victims published between July 17 and August 1 span the United States, Australia, the UAE, Colombia, and Switzerland.

The post-exploitation toolkit documented by Resecurity is methodical:

• KNUCKLEBALL — a Python loader that injects malicious Java agents into legitimate running processes, hiding inside trusted process trees to evade behavioral detection
• ORANGETAIL — a custom Java web shell with AES-128-ECB encrypted communications, styled after the Behinder 3.x framework
• Suo5 — an open-source HTTP proxy tunneled through the compromised appliance for quiet lateral movement deeper into the network
• ROOTRUN — a setuid ELF binary planted for persistent root execution by any unprivileged process, surviving service restarts and providing a durable re-entry point

One behavioral signature worth flagging: network traffic from these implants used the user-agent string Mozilla/6.0 (Windows NT 11.0; Win64; x64) — a version and OS combination that does not exist in the wild. If that string appears in your logs, you have a problem.

The Credential Harvest Hidden Inside

The most underappreciated part of these intrusions is what INC does once they have root. Because the SMA 1000 sits between remote users and internal directory services, it handles authentication traffic that contains credentials. Attackers deployed a shell script running tcpdump against unencrypted LDAP traffic on TCP/389 — passively capturing usernames and plaintext passwords from appliance-to-Active-Directory communications. No brute force. No cracking. Just listening to a pipe that happened to be in cleartext.

They also extracted active session databases and TOTP seeds from the appliance's storage. Any active remote-access session that existed during the intrusion window should be considered fully compromised — not just suspicious.

Patch first, then rotate every Active Directory account that authenticated through this device. Those two steps are inseparable.

Are You Affected?

The vulnerabilities affect SMA 1000 Series models 6210, 7210, and 8200v only. This is distinct from the SMA 100 series (SMA 200, 400, etc.) — different product line, different firmware, different CVE exposure. Verify which hardware you are running before assuming you are or are not in scope.

Vulnerable firmware versions:

• 12.4.x branch: 12.4.3-03245, 12.4.3-03387, 12.4.3-03434
• 12.5.x branch: 12.5.0-02283, 12.5.0-02624, 12.5.0-02800

What to Do Now

Update firmware immediately. Target builds are 12.4.3-03453 (platform-hotfix) for the 12.4.x branch and 12.5.0-02835 for the 12.5.x branch. Both are available on SonicWall's MySonicWall portal.

Hunt for compromise before declaring clean. With exploitation dating to June 22 and patches landing July 14, there is a three-week exposure window even for organizations that patched on day one. Check for unexpected binaries in /var/tmp/ (particularly lib.sh), unfamiliar outbound proxy connections, unknown Java processes, and tcpdump running under root or the couchdb service account.

Rotate Active Directory credentials. Specifically any accounts used for remote-access authentication through the appliance. LDAP service accounts especially. Invalidate all sessions that were active during the June 22 to July 14 window.

Lock down the AMC interface. The Appliance Management Console should not be reachable from the public internet under any circumstances. If it is, address that regardless of patch status — patching closes this specific chain, but an exposed admin console is a standing invitation for whatever comes next.

Both CVEs are in CISA's Known Exploited Vulnerabilities catalog. Ransomware operators have a reliable exploit, an active victim pipeline, and no reason to slow down on unpatched targets. At Falcon Internet, perimeter appliance firmware is a standing item in our 24x7x365 NOC monitoring rotation — because the device guarding the edge is exactly where attackers look first.