SonicWall SMA Zero-Day Vulnerabilities Used to Gain Root Access Before Disclosure

Volexity has reported the discovery of a campaign exploiting previously unknown vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series VPN devices. According to the researchers, the attacks began before the flaws in question were publicly disclosed by the vendor.

The activity is attributed to a new, previously undocumented group that has been assigned the designation UTA0533. It appears that the attackers had been using the vulnerabilities as zero-days since June 22, 2026 — that is, some time before official information about the problems in SMA devices became available.

How the Discovery Came About

Information about the incidents came to light thanks to an investigation carried out by Volexity specialists as part of their response to one of the compromised cases. It was during this work that the analysts detected signs of the exploitation of previously undocumented vulnerabilities in the SonicWall product.

According to the available data, successful exploitation allowed the attackers to gain root access to the targeted devices — that is, the highest level of privileges, granting full control over the system.

Why the Incident Matters

SonicWall SMA appliances are devices for providing secure remote access to corporate networks, widely used as VPN gateways. The compromise of such edge devices poses a heightened danger, as it opens a path for attackers into the internal infrastructure of victim organizations.

The fact that the vulnerabilities were exploited before their public disclosure indicates that the attackers possessed information about the product's weaknesses before it became available to the broader security community and to the vendor itself. This underscores the importance of promptly applying security updates and monitoring perimeter devices even in the absence of public information about vulnerabilities.

Details about the technical specifics of the exploitation, the scale of the campaign, and the list of affected organizations remain limited for now.

Source: The Hacker News