> TritonInfoSec News
Home / Jul 21, 2026 / Story
0
#1 The Hacker News general July 19, 2026 at 13:18 UTC

SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access

By [email protected] (The Hacker News)

AI Summary

Threat actor UTA0533 (tracked by Volexity) exploited two SonicWall SMA 1000 series VPN appliance zero-days — CVE-2026-15409 and CVE-2026-15410 — beginning as early as June 22, 2026, weeks before public disclosure, achieving root access and deploying custom malware. The pre-patch exploitation window and targeting of widely-deployed VPN infrastructure makes this critical for organizations running SMA1000 appliances to investigate for compromise indicators immediately.

Read full article → https://thehackernews.com/2026/07/sonicwall-sma-ze…

Relevance score: 88.0/100

# More from July 21

  1. 2
    Critical ServiceNow code execution flaw now exploited in attacks BleepingComputer
  2. 3
    'WP2Shell' Opens Millions of WordPress Sites to Remote Takeover Dark Reading
  3. 4
    Hugging Face discloses breach linked to autonomous AI agent BleepingComputer
  4. 5
    Russian Intelligence Hacks IP Cameras to Spy on Military Logistics Across NATO States and Ukraine The Hacker News
  5. 6
    UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices wih Malware The Hacker News
  6. 7
    FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware The Hacker News
  7. 8
    SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines The Hacker News
  8. 9
    Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution The Hacker News
  9. 10
    New HollowGraph malware uses Microsoft Graph for stealthy C2 comms BleepingComputer