Volexity Uncovers Zero-Day Campaign Targeting SonicWall VPN Appliances

Volexity uncovered an active zero-day campaign by threat actor UTA0533 that chained two SonicWall SMA1000 vulnerabilities (CVE-2026-15409 CVSS 10.0 and CVE-2026-15410 CVSS 7.2) to escalate from unauthenticated access to root, deploy custom malware (e.g., ROOTRUN, KNUCKLEBALL, ORANGETAIL), persist across reboots, and capture authentication credentials; SonicWall released patches after confirming active exploitation.