SonicWall SMA1000 Zero‑Day Flaws Actively Exploited Before Public Disclosure

Two critical vulnerabilities (CVE‑2026‑15409 and CVE‑2026‑15410) affect SonicWall Secure Mobile Access 1000 series VPN appliances. CVE‑2026‑15409 is a pre‑authentication server‑side request forgery that lets unauthenticated attackers reach internal services; CVE‑2026‑15410 is a post‑authentication code‑injection flaw that permits arbitrary OS command execution with administrator privileges. Both have been added to CISA’s Known Exploited Vulnerabilities Catalog and received CVSS scores of 10.0 (critical) and 7.2 (high).

A threat actor identified as UTA0533 was observed chaining these zero‑days and deploying custom malware to gain root access on at least two SMA devices before the flaws were publicly disclosed on June 22, 2026. The attacker created persistent footholds, modified startup scripts, and captured LDAP credentials. SonicWall issued patches for both CVEs later that week.