SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access

A previously unknown threat actor exploited zero-day vulnerabilities in SonicWall's Secure Mobile Access 1000 series VPN appliances before they were publicly disclosed. The exploitation occurred prior to June 22, 2026, and was used to gain root access. The threat actor is being tracked by cybersecurity company Volexity under the name UTA0533. This discovery was made during an incident response investigation. Volexity's investigation led to the identification of this threat actor's activity. The threat actor's actions were uncovered earlier this year.