SonicWall customers under threat as attackers exploit 2 zero-days

SonicWall disclosed two zero-day vulnerabilities in SMA1000 appliances that were actively exploited and chained to allow attackers to escalate from no access to full system compromise; researchers observed exploitation beginning June 22 with likely ransomware intent. SonicWall released fixes and mitigation scripts, CISA added the flaws to its known exploited vulnerabilities catalog, and investigators provided indicators of compromise while the vendor and third parties assist affected customers.