SonicWall SMA1000 Zero-Days Exploited for Weeks to Deploy Malware

Two vulnerabilities in SonicWall SMA1000 VPN appliances were exploited as zero-days for weeks before being disclosed, allowing attackers to install custom malware on affected devices. SMA1000 is widely deployed in enterprise remote-access environments, making unpatched appliances a high-value target. Organizations running SMA1000 should patch immediately, assume compromise if the appliance was internet-exposed prior to patching, and review logs for signs of unauthorized access.