CRITICAL: SonicWall SMA 1000 Zero-Days Chained for Root, Exploited a Month Before Disclosure
A previously unknown threat actor tracked as UTA0533 chained two SonicWall SMA 1000 zero-days, CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410, to gain root on internet-facing VPN appliances starting June 22, 2026, weeks before disclosure. Root access let attackers steal credentials, session databases, and MFA seed configurations, then pivot into corporate networks. There are no workarounds. Patch to 12.4.3-03453 or 12.5.0-02835 immediately.