SonicWall SMA1000 CVE-2026-15409/15410 wsproxy SSRF Exploit (INC/UTA0533)
This rule detects potential exploitation attempts against SonicWall SMA1000 appliances, specifically targeting the /wsproxy endpoint using a custom 'SMA Connect Agent' user agent string. This behavior is associated with SSRF vulnerabilities (CVE-2026-15409 and CVE-2026-15410) identified as being utilized by the threat actor group UTA0533 in campaigns involving INC Ransomware.
Suricata
