# Zero-Day Campaign Targeting SonicWall VPN Appliances Uncovered Unknown hackers exploited vulnerabilities in SonicWall SMA 1000 VPN devices. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-07-20 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/b46e484c-4f56-4ae8-9475-8004384ffd82 ## Zero-Day Attack Detected Unknown hackers exploited two zero-day vulnerabilities in SonicWall SMA 1000 VPN devices to gain root access. The attacks began in June 2026 and were carried out before patches were released. ## Details of the Vulnerabilities The first vulnerability, CVE-2026-15409, was identified as a Server-side request forgery (SSRF) issue. The second, CVE-2026-15410, was a post-authentication code injection flaw. These vulnerabilities allowed remote execution of root-level commands. ## Identity of the Attacker The attacker, tracked by Volexity as UTA0533, used malware specifically designed for SonicWall SMA VPN devices. The group appears to have prepared specifically for this target. ## Impact of the Attack The attackers gained root access, allowing them to access stored or cached credentials. They also had the potential to capture network traffic and intercept credentials, highlighting the high-risk nature of VPN devices. ## Patches and Measures SonicWall patched both vulnerabilities this week and confirmed active exploitation. The company discovered the vulnerabilities through an internal report and investigated multiple incidents. ## Volexity's Analysis Volexity analyzed logs and security telemetry from two compromised SonicWall devices. The team collected RAM, selected files, and full disk images. Memory analysis revealed additional evidence of the attackers' activities. ## Key Takeaways This attack underscores the critical nature of VPN devices as targets. The use of custom malware suggests an increase in targeted attacks. Timely application of security patches is crucial. ## Sources covering this story - https://securityaffairs.com/195626/hacking/volexity-uncovers-zero-day-campaign-targeting-sonicwall-vpn-appliances.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._