SonicWall SMA: zero-day chain gave attackers root access to VPN appliances

Colleagues, I’d like to highlight a cybersecurity incident: researchers discovered a zero-day chain in SonicWall SMA 1000 that was exploited before public disclosure.

What we know:
• CVE-2026-15409 enabled a security bypass and access to local services.
• CVE-2026-15410 was used for privilege escalation and root-level command execution.
• According to researchers, attackers could deploy a web shell, establish persistence, and harvest credentials.

Why it matters: if a VPN appliance is compromised, not only the perimeter is at risk, but also internal connections, traffic, and secrets.

Patches are already available, but prompt updating and device verification are critical. How do you prioritise incidents like this in your environment?

#cybersecurity #VPN #ZeroDay #SonicWall