SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access

A previously unknown threat actor, tracked as UTA0533 by Volexity, has been exploiting zero-day vulnerabilities in SonicWall's SMA 1000 series VPN appliances since at least June 22, 2026, to gain root access¹. This exploitation occurred before the public disclosure of the vulnerabilities, putting defenders at a significant disadvantage. The threat actor's activities were uncovered during an incident response investigation, highlighting the group's ability to capitalize on unpatched flaws. SonicWall's SMA 1000 series VPN appliances are widely used, making this exploitation a significant concern for organizations relying on these devices for secure remote access. The fact that these zero-days were exploited before disclosure means that defenders were already behind in responding to the threat, making it a pressing issue for security teams to patch and mitigate the vulnerabilities as soon as possible. This incident underscores the importance of prompt patching and highlights the ongoing cat-and-mouse game between attackers and defenders.