SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access

2 sources

Threat actor UTA0533 exploited two zero-day vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances prior to patching on June 22, 2026, achieving root access; recent investigations indicate INC Ransomware is now actively weaponizing the vulnerability chain.

Reader briefpress 1 · 2

No reader reading of this story yet.

← Back to feed

vulnerabilities2 sources · 2h ago

SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access

Threat actor UTA0533 exploited two zero-day vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances prior to patching on June 22, 2026, achieving root access; recent investigations indicate INC Ransomware is now actively weaponizing the vulnerability chain.

Affected▪ CouchDB▪ CVE-2026-15409▪ CVE-2026-15410◇ Douglas McKee▪ INC Ransomware▪ KNUCKLEBALL▪ ORANGETAIL▪ Rapid7▪ ROOTRUN◇ Sean Koessel▪ SMA1000 Secure Mobile Access▪ SonicWall

Lens

No Reader read of this story yet.

Perspectives

The story's competing narratives, side by side — grouped by stance, with every outlet's origin and affiliation visible.

Perspective analysis pending — it generates as coverage from more origins arrives.

What to expect

First-order impacts with their likely second-order effects — direction and horizon per node.

Impact analysis pending.

Sources (2)

[1]BleepingComputerSonicWall SMA1000 flaws exploited as zero-days to push custom malwareneutral
[2]The Hacker NewsSonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Accessalarmist

Ask anything about this story — every answer cites this story's own sources, or says it can't.