important · Edge — SonicWall
SMA1000 compromise is being converted into Active Directory credential theft and DCSync.
Affects
SonicWall SMA1000, an enterprise VPN and secure-access appliance deployed physically or virtually at the network edge.
The public proxy reaches localhost Erlang; its hard-coded cookie yields appliance commands, stored LDAP credentials and access to internal directory services.
Detail and 4 sources
Campaign artifacts show SAM and LSA extraction and DCSync, while working public code covers the initial unauthenticated entry chain.
After appliance compromise, containment has to include the directory credentials and systems reached from the appliance.
Sources
ResearchRapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days being Actively Exploited (CVE-2026-15409, CVE-2026-15410)ResearchSecurity AdvisoryCode / PoChttps://github.com/remmons-r7/rapid7-CVE-2026-15409SecondaryMass-exploited SonicWall SMA1000 appliances became Active Directory attack platforms