SonicWall SMA1000: what Rapid7 saw before disclosure

If you patched your SonicWall SMA1000 yesterday and moved on, Rapid7’s writeup today is the one that tells you whether you’re actually done. Their MDR team caught the exploitation before SonicWall’s July 14 advisory went out — before the CVEs hit KEV, before the BOD 26-04 clock started ticking toward July 17. What they saw is the honest reason CISA’s deadline is aggressive.

What the attackers actually did

Per Rapid7, threat actors chained the two flaws to root the appliance, then treated it exactly like the piece of trusted infrastructure it is. They pulled credentials, session databases, and MFA seeds off the box. Then they walked into the internal network — pivoting to domain controllers with the SMA1000 as a persistent backdoor. That’s not “we saw scanning.” That’s a full pre-disclosure intrusion pattern against internet-facing SMA 1000 appliances, targeted, and it was running before SonicWall’s PSIRT confirmed exploitation publicly.

The technical mechanics of the chain — the SSRF that opens a websocket tunnel to localhost-only services, the local privilege escalation via the hotfix-removal workflow — are in SNWLID-2026-0008 if you need them for detection tuning. Read them there.

Patched isn’t cleaned

If your appliance was internet-reachable and on a vulnerable build (12.4.3-03245, -03387, or -03434, or 12.5.0-02283, -02624, or -02800) before you patched to 12.4.3-03453 or 12.5.0-02835, the correct assumption today is that you were exposed, not that you weren’t. Rapid7 spells out the follow-through and it isn’t optional:

• Pull the appliance logs and check for the IoCs SonicWall listed: /__api__/login and /__api__/logout returning HTTP 200 in extraweb_access.log, /wsproxy requests with HTTP 101, hotfix rollbacks with path traversal in ctrl-service.log, and unauthorized routes in /var/lib/unit/conf.json. A hit means the appliance is compromised, not merely vulnerable.
• Re-image, don’t re-patch, if you find compromise indicators. A hotfix on top of an attacker-controlled box gives you a patched attacker-controlled box.
• Rotate every credential that touched the appliance. Service accounts, admin accounts, break-glass. The password database is one of the things the attackers took.
• Reset every TOTP token issued through this SMA1000. MFA seeds don’t rotate on their own, and a seed lifted before the patch is still valid after it.
• Walk the domain controllers. Rapid7 saw the attackers pivot there. If your SMA1000 was compromised and you stopped at the perimeter, you missed the actual objective.

Priority call

Patch is priority one and the CISA deadline is Thursday, July 17. But if you patched and did nothing else, credit for the patch doesn’t carry to the credentials, the MFA seeds, or the accounts already established downstream. The order for the rest of this week: patch → hunt for the IoCs → assume the DC side needs a look → rotate everything that touched the box. July 17 is the compliance clock; the actual cleanup takes longer and is what determines whether the next incident is yours or somebody else’s.

Volexity’s Sean Koessel and Steven Adair also worked the investigation, credited alongside SonicWall PSIRT’s Adam Babis on the advisory itself. Rapid7’s MDR call is the one that seeded the pre-disclosure detection.