CVE-2026-15409 handed one operator 534 Active Directory accounts through SonicWall WorkPlace portals

The chain is short. An unauthenticated request to /wsproxy on the WorkPlace portal makes the appliance connect to port 1050 on itself, where an Erlang service tied to CouchDB is listening ^[4]. A cookie hardcoded in the appliance firmware completes the Erlang connection and gets the attacker onto the [email protected] node ^[5]. Commands sent to that node execute operating system commands with the privileges of the couchdb account ^[5]. Automated, the whole sequence finishes in a few seconds ^[6].

The credential theft that follows needs no per-device secret. The operator's ldap_extract.py reads /usr/local/extranet/etc/policy_file.xml from each compromised appliance and decrypts the LDAP passwords stored in it ^[14]. Decryption uses a fixed 32-byte AES key embedded in ASAPPasswordUtil.class, which means the same key works on every SMA1000 running vulnerable firmware ^[15]. Rotating a bind password does not change the key; while the firmware is vulnerable, the replacement password sits in the same file and decrypts the same way ^[14][15].

With valid LDAP credentials, the operator pulled a standalone Linux build of Impacket's secretsdump to /tmp/secretsdump with curl and ran it from the appliance against internal Windows systems ^[16]. "This approach could help the actor evade detection, as organisations typically have substantially less visibility into the underlying operating systems of firewall and VPN appliances than into managed Windows and Linux hosts monitored by EDR," the Hunt.io report said ^[8]. A VPN appliance reaching internal systems produces no EDR alert on the Windows endpoints and no rogue-process entry in Windows event logs, and it falls outside most SIEM rules tuned for managed hosts ^[17].

Where the stolen LDAP account lacked replication rights, the operator fell back to LSA secrets recovered by secretsdump, which can hold the NTLM hash of a domain controller's machine account. The scripts searched the output for account names ending in $, pulled the hashes, and issued pass-the-hash DCSync requests through the compromised appliance ^[18]. Five environments lost their entire Active Directory database that way, across seven domain controllers ^[13].

The hit rate is in the operator's own files. Of 250 target appliances, 168 gave up LDAP configuration files, about 67 percent ^[12][1]. Those 168 files carried 534 Active Directory accounts, an average of 3.2 bind credentials per leaking appliance, spread across 160 domain names and 255 internal LDAP server addresses ^[12][2]. Full directory replication landed on 2 percent of the target set ^[13][3].

The compression matters more than the scores. Rapid7's MDR team saw exploitation before SonicWall's July 14 advisory ^[10]. Rapid7 published a proof of concept on July 15, and by July 16 the operator was running it as a 50-thread mass scanner, one day later ^[9][4].

What the record does not carry is the council's own account. Hunt.io rates the link between the King's Lynn and West Norfolk incident and this campaign at moderate confidence ^[2]. The material does not say what the council lost, and it contains no statement from the council or SonicWall on the vector. The AttackCapture crawl and the council's announcement fall on the same date, July 17 ^[11][1].