SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch

Volexity reported that threat actor UTA0533 exploited two SonicWall zero-day vulnerabilities (CVE-2026-15409 RCE and CVE-2026-15410 auth/privilege bypass) to compromise SMA and firewall appliances, deploy custom persistence malware, and perform lateral movement and data collection during a weeks-long pre-patch window; organizations are urged to apply SonicWall PSIRT patches, review management logs, audit firmware integrity, and restrict management access.