Volexity Identifies Active Zero-Day Exploitation Campaign Targeting SonicWall VPN Appliances

If you’re running SonicWall SMA 1000 series appliances, it’s time to stop what you’re doing and check your logs. Security researchers at Volexity have pulled the curtain back on an active, nasty zero-day campaign that’s been running since June 22, 2026. The culprits? A threat actor group dubbed UTA0533. They aren't just poking around; they’ve figured out how to chain two zero-day vulnerabilities to gain root-level access, letting them run whatever commands they want and siphon off credentials before you even know they’re in the building.

Volexity caught wind of this after digging into some compromised infrastructure, using their memory analysis tools—specifically Volexity Volcano—to spot the digital fingerprints of the intrusion. According to the detailed analysis provided by Volexity, this wasn't a generic "spray and pray" attack. The malware was custom-built, engineered specifically to thrive in the unique, locked-down environment of SonicWall SMA appliances.

The Technical Breakdown: A Perfect Storm

The attack is a classic two-step that turns a secure gateway into an open door.

First up is CVE-2026-15409. It’s a Server-Side Request Forgery (SSRF) flaw, and it’s a big one—a CVSS score of 10.0. By hitting the /wsproxy endpoint, an unauthenticated attacker can bypass the appliance's security checks entirely. They’re effectively walking through the front door without a key.

Once they’re past that first hurdle, they pivot to the second vulnerability: CVE-2026-15410. This is a post-authentication code injection flaw with a CVSS score of 7.2. With the first exploit as their leverage, they can execute arbitrary OS commands with full root-level privileges. As Security Affairs pointed out, once these two are chained, the appliance is essentially theirs to command.

Operational Details and How to Fight Back

UTA0533 knows their craft. They’ve kept their operational security tight, using custom malware that’s designed to evade the usual detection methods. By leaning on the /wsproxy endpoint, they’ve highlighted a painful truth: edge devices are the most critical, yet often most overlooked, parts of our network perimeter.

SonicWall has already pushed out patches to plug these holes. If you’re managing these appliances, your first move should be the official PSIRT advisory. Get those systems updated to the latest firmware immediately.

Beyond just hitting "update," here is your checklist for securing the perimeter:

• Patch, then patch again: Ensure both CVE-2026-15409 and CVE-2026-15410 are remediated.
• Audit the logs: Scour your system logs, specifically looking for any weirdness coming from that /wsproxy endpoint.
• Hunt for ghosts: Keep an eye out for anomalous processes or unknown binaries. If it doesn't belong on the appliance, it’s likely UTA0533’s handiwork.
• Watch the traffic: Look for network patterns that scream "SSRF attempt."

As noted by Security Affairs, the danger here is that these vulnerabilities don't require a password or a stolen credential to trigger. If your device is exposed, it’s vulnerable. The window of opportunity for these attackers is wide open until you close it.

Security teams need to be proactive. Use the indicators of compromise (IOCs) released by the researchers to scan your environment. As SocDefenders rightly emphasizes, patching is only half the battle. You also need to perform a deep forensic review of your logs to ensure the attackers didn't establish persistence before you applied the fix.

The investigation into UTA0533 is still unfolding. We’re watching to see how their tactics shift, but one thing is clear: when attackers target VPN appliances, they aren't looking for a quick win—they’re looking for a foothold into your entire network. Keep your firmware current, keep your administrative access restricted to the bare minimum, and stay alert. In the world of edge security, complacency is the most expensive mistake you can make.