SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access

A previously undocumented threat actor has been attributed to the exploitation of recently disclosed SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances as zero-days prior their public disclosure since June 22, 2026. Cybersecurity company Volexity is tracking the activity under the moniker UTA0533. The discovery was made following an incident response investigation earlier this

The article describes a previously undocumented threat actor (UTA0533) exploiting two zero-day vulnerabilities, CVE-2026-15409 and CVE-2026-15410, in SonicWall SMA 1000 series VPN appliances to chain them for arbitrary command execution and root-level device takeover.[3][4] These appliances often sit in front of critical infrastructure, including AI workloads and data services, making compromise a significant upstream risk to any AI systems that depend on them for secure remote access or data flows. From a RealGround perspective, this is primarily an AI supply chain risk: vulnerable VPN gateways can be abused as an entry point to reach AI models, training data, and orchestration systems behind them, enabling lateral movement, exfiltration, or tampering with AI pipelines.[3][8] Organizations should treat network appliances in front of AI environments as critical dependencies, ensure rapid patching and segmentation, and maintain an SBOM and asset inventory so that exploitation of infrastructure zero-days can be quickly correlated with potential AI-system exposure.