SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access

SonicWall's Secure Mobile Access (SMA) 1000 series VPN appliances have been exploited by a previously undocumented threat actor using zero-days before their public disclosure on June 22, 2026.

Attack Vector and Vulnerability Mechanics

The two vulnerabilities, when chained together, allow threat actors to gain root-level capabilities on SonicWall's mobile access appliances. This is made possible by the combination of a Server-Side Request Forgery (SSRF) vulnerability and a code injection vulnerability, allowing attackers to execute arbitrary code on the server.

Technical Depth

The SSRF vulnerability (CVE-2026-15409) enables an attacker to forge requests to internal services, while the code injection vulnerability (CVE-2026-15410) allows for the execution of malicious code on the appliance. By chaining these vulnerabilities, an attacker can gain unauthorized access to the appliance, potentially leading to further exploitation.

According to Volexity, the threat actor, tracked as UTA0533, has been exploiting these vulnerabilities since before their public disclosure.

Who Is Affected

SonicWall SMA 1000 series VPN appliance users are directly affected by these zero-days. The vulnerabilities can be exploited to gain root access to the appliances, potentially putting all connected devices and data at risk.

What the Sceptics Say

Some may argue that since the vulnerabilities have been patched by the vendor, the risk is mitigated, and the situation is under control. However, the fact that these zero-days were exploited before disclosure highlights the persistent threat landscape and the need for continuous vigilance.

How to Defend

• Apply patches immediately: Ensure that all SonicWall SMA 1000 series VPN appliances are updated with the latest security patches.
• Monitor for suspicious activity: Regularly check for signs of unauthorized access or malicious activity on the appliances and connected devices.
• Implement additional security measures: Consider adding extra layers of security, such as multi-factor authentication and intrusion detection systems, to protect against similar threats.

Key Takeaways

1. Security Teams: Prioritize patching SonicWall SMA 1000 series VPN appliances and enhance monitoring for suspicious activity.
2. CISOs: Review the security posture of remote access solutions and consider implementing additional security measures to protect against zero-day exploits.
3. Developers: Focus on secure coding practices to prevent vulnerabilities like SSRF and code injection, which can be exploited by threat actors.
4. End Users: Be cautious when accessing remote services and report any unusual activity to the security team.

Sources

• The Hacker News: SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access
• Dark Reading: Inc Ransomware Exploits SonicWall SMA Zero-Days
• SecurityWeek: Fresh SharePoint Vulnerability Exploited Soon After Disclosure
• CyberScoop: SonicWall customers under threat as attackers exploit 2 zero-days
• HackRead: Microsoft’s July 2026 Patch Tuesday fixes 622 flaws and 2 exploited zero-days