SonicWall SMA zero-days were exploited weeks before disclosure

Volexity disclosed that two SonicWall SMA 1000 zero-days (CVE-2026-15409 SSRF and CVE-2026-15410 code injection) were exploited in the wild to tunnel to localhost services, gain root, and install in-memory Java-based backdoors and a proxy to capture credentials and intercept traffic; affected appliances should be re-imaged, credentials rotated, TOTP reset, and logs/IOCs/YARA rules reviewed to detect compromise.