# SonicWall SMA Zero-Days Exploited to Gain Root Access Threat actors exploited newly discovered vulnerabilities in SonicWall SMA VPN devices. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-07-19 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/54446f16-43a7-42a1-97ba-38bb8f617b95 ## Zero-Day Vulnerabilities Discovered Two critical vulnerabilities, CVE-2026-15409 and CVE-2026-15410, were found in SonicWall Secure Mobile Access (SMA) 1000 series VPN devices before public disclosure. These flaws allowed root access. Cybersecurity firm Volexity attributed the exploits to a threat actor dubbed UTA0533. ## Threat Actor's Methods UTA0533 used malware specifically designed for SonicWall SMA devices and multiple zero-day exploits. Attackers planted ELF executables and Python scripts to maintain persistence, modifying NGINX Unit configurations to create backdoors and gain full control over the systems. ## Technical Details of the Flaws CVE-2026-15409 enables unauthorized WebSocket tunneling to local services, while CVE-2026-15410 involves command injection and privilege escalation. Combined, these vulnerabilities allow complete device takeover. SonicWall has released patches to address these issues. ## Impact of the Attack Attackers intercepted unencrypted LDAP traffic to steal credentials. They also exploited CouchDB to read hardware IDs and bypass authentication. These techniques provided full system access, highlighting severe security weaknesses in the affected devices. ## Recovery and Mitigation The compromised organization rebooted devices to remove memory-resident malware. However, persistent files may require a factory reset for complete cleanup. SonicWall urges users to apply the latest patches immediately to prevent further exploitation. ## Critical Cybersecurity Alert This attack underscores the critical nature of VPN devices as high-value targets. Organizations must adopt proactive measures against zero-day exploits and implement continuous monitoring. Analyses by firms like Volexity and Rapid7 provide vital insights for preventing similar breaches. ## Sources covering this story - https://thehackernews.com/2026/07/sonicwall-sma-zero-days-exploited.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._