SonicWall SMA Zero-Day Chain Lets Attackers Execute Commands as Root

A newly disclosed threat actor, tracked as UTA0533, chained two zero-day vulnerabilities to compromise SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances and achieve full root-level command execution. The campaign was uncovered during an incident response engagement in early July 2026, after suspicious authentication and lateral movement attempts were traced back to the appliances. The attack exploited CVE-2026-15409 , a critical SSRF flaw (CVSS 10.0) in the…