> TritonInfoSec News
Home / Jul 22, 2026 / Story
0
#4 BleepingComputer general July 20, 2026 at 22:23 UTC

SonicWall SMA1000 flaws exploited as zero-days to push custom malware

By Lawrence Abrams

AI Summary

Two SonicWall SMA1000 zero-days — CVE-2026-15409 and CVE-2026-15410 — were exploited for weeks before patches were available by threat actor UTA0533 (tracked by Volexity), who installed custom malware on vulnerable VPN appliances. Pre-patch exploitation of VPN appliances for custom implant delivery represents a high-impact supply chain risk for enterprise network perimeters.

Read full article → https://www.bleepingcomputer.com/news/security/son…

Relevance score: 88.0/100

# More from July 22

  1. 1
    Critical SharePoint RCE flaw exploited to steal machine keys BleepingComputer
  2. 2
    Critical wp2shell WordPress flaws exploited to install webshells BleepingComputer
  3. 3
    Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access The Hacker News
  4. 5
    Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution The Hacker News
  5. 6
    FakeGit campaign uses 7,600 GitHub repos to push SmartLoader malware BleepingComputer
  6. 7
    Police dismantle Kratos phishing platform, arrest developer BleepingComputer
  7. 8
    New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack The Hacker News
  8. 9
    Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes BleepingComputer
  9. 10
    HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050 The Hacker News