SonicWall SMA 1000 Zero-Days Exploited in the Wild Before Public Disclosure

Volexity has identified a previously undocumented threat cluster, UTA0215, actively exploiting zero-day vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series appliances since at least June 22, 2026, achieving unauthenticated RCE, root access, and persistence before vendor disclosure; organizations should urgently apply patches, review IOCs and logs, rotate credentials, segment networks, and consider taking affected appliances offline until remediated.