SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch

Two SonicWall zero-day vulnerabilities, CVE-2026-15409 and CVE-2026-15410, were exploited in the wild for weeks before a patch was available. Volexity attributes the exploitation to a threat actor it tracks as UTA0533, which used the flaws to deliver custom malware onto compromised devices. Organizations running affected SonicWall products should apply the patch immediately and review logs for signs of compromise dating back to before the fix shipped, given the extended exploitation window.