SonicWall SMA1000 flaws exploited as zero-days to push custom malware

**Executive summary:** Volexity reports that threat actor UTA0533 exploited two zero-day SonicWall SMA1000 flaws (CVE-2026-15409 SSRF and CVE-2026-15410 command injection) to create WebSocket tunnels, retrieve device identifiers, execute commands as root, and deploy custom malware (KNUCKLEBALL deploying Sou5 and ORANGETAIL), enabling reverse-proxy and remote webshell access; SonicWall has released patches and urged immediate updates.