Mass Exploitation of SonicWall SMA1000 SSRF Flaw (CVE‑2026‑15409) Leads to Credential Theft at UK Council
What Happened — A critical SSRF vulnerability (CVE‑2026‑15409, CVSS 10.0) in SonicWall SMA1000 appliances was weaponized in a mass‑exploitation campaign. The flaw allowed unauthenticated attackers to reach an internal Erlang service, use a hard‑coded cookie, and execute OS commands, ultimately dumping Active Directory credentials from the victim’s network. The Borough Council of King’s Lynn and West Norfolk confirmed that the attack leveraged this chain to steal hundreds of AD accounts.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous monitoring of firewall/VPN appliance configurations and evidence that patches are applied promptly.
- Highlights gaps in credential protection and privileged‑account visibility that a control‑assurance program must capture and audit.
- Shows how a single unpatched network device can become a foothold for large‑scale credential theft, underscoring the importance of robust access‑control controls and defensible logs.
Who Is Affected – Local government bodies, public‑sector IT departments, and any organization relying on SonicWall SMA appliances for remote access.
Recommended Actions
- Verify firmware version on all SonicWall SMA devices; apply SonicWall’s July 14 advisory patch immediately.
- Deploy continuous configuration monitoring to detect unauthorized changes to firewall management interfaces.
- Enforce strict credential‑access monitoring and rotate privileged AD passwords after any suspected compromise.
- Incorporate firewall logs into your SIEM/EDR to surface anomalous internal connections.
Technical Notes – The SSRF exploits the WorkPlace portal’s WebSocket proxy (/wsproxy) to reach a local CouchDB Erlang node on port 1050. A hard‑coded cookie authenticates the attacker, who then runs commands as the couchdb user. The exploit chain can be automated in seconds and was observed in the wild within three days of the vulnerability’s disclosure. Source: SecurityAffairs