SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch

The zero-days CVE-2026-15409 and CVE-2026-15410 were exploited by a threat actor tracked by Volexity as UTA0533. The post SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch appeared first on SecurityWeek .

The article reports that two zero-day vulnerabilities in SonicWall SMA 1000 appliances, CVE-2026-15409 (critical unauthenticated SSRF) and CVE-2026-15410 (post-authentication code injection), were exploited for weeks by threat actor UTA0533 to deliver custom malware before patches were released.[1][3][5] These flaws can be chained to provide unauthenticated, remote root-level command execution on affected appliances, and have been confirmed as actively exploited and added to CISA’s Known Exploited Vulnerabilities catalog.[3][6][8] From a RealGround perspective, any AI workloads or AI agents that rely on SonicWall-protected networks or remote access infrastructure inherit this exposure risk, making SonicWall a critical component in the AI security supply chain. Organizations should integrate these network security components into their AI SBOM and supply-chain risk management, rapidly patch and forensically review appliances, and treat compromised devices as potential pivots into AI systems, data stores, and agent execution environments.