SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access

UTA0533 has been actively exploiting two zero-day vulnerabilities in SonicWall SMA 1000 series VPN appliances since June 22, 2026, before vendor disclosure. The attacker chains CVE-2026-15409 and CVE-2026-15410 to achieve unauthenticated RCE, privilege escalation, and persistence via custom malware. Any organization running affected SMA appliances is at immediate risk of full compromise and lateral movement.