CYBERSECURITYTRACKER
TRACKING6,506 stories in this site build1,309 vulnerability news stories in this site build
Permanent story citation

SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 2840

As cited

Copy frozen at (site build).

vulnerabilities

SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch

Two zero-day vulnerabilities in SonicWall products (CVE-2026-15409 and CVE-2026-15410) were exploited in the wild to deploy custom malware, with attacks occurring for weeks before patches became available. The threat actor tracked as UTA0533 conducted the campaign.

Why it matters: Organizations running SonicWall appliances face active exploitation risk and must prioritize patching these zero-days immediately to close the attack vector used for malware delivery.

Source published
First seen by Cybersecurity Tracker

Source attribution

Correction

Correction recorded as of .

vulnerabilities

SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch

Two zero-day vulnerabilities in SonicWall products (CVE-2026-15409 and CVE-2026-15410) were exploited in the wild to deploy custom malware, with attacks occurring for weeks before patches became available. The threat actor tracked as UTA0533 conducted the campaign.

Why it matters: Organizations running SonicWall appliances face active exploitation risk and must prioritize patching these zero-days immediately to close the attack vector used for malware delivery.

VendorsSonicWall
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary