From WSProxy to Root: INC ransomware and SonicWall SMA Exploit Chain

On July 14, 2026 SonicWall released patches for two actively exploited SMA 1000 vulnerabilities (CVE-2026-15409 pre-auth WebSocket proxy bypass and CVE-2026-15410 remove_hotfix path traversal) that were chained in the wild (pre-disclosure exploitation from June 22, 2026) to achieve full root compromise, credential harvesting, and deployment of a multi-stage malware toolkit subsequently weaponized by INC Ransomware; the report provides attack-chain reconstruction, malware and IOC details, attacker infrastructure, and recommended incident response and hardening actions.