🛡️ **SONICWALL SMA1000 ZERO-DAY FLAWS ACTIVELY EXPLOITED FOR MALWARE DELIVERY — PATCH IMMEDIATELY**
Published Monday, July 20, 2026 at 08:47 PM PT BLUF: SonicWall SMA1000 secure access appliances are being actively exploited via unpatched zero-day vulnerabilities to deploy custom malware. Organizations running SMA1000 devices should apply available patches immediately and assume compromise if exploitation occurred before patching. DETAILS Two zero-day vulnerabilities in SonicWall SMA1000 have been confirmed under active exploitation in the wild; one vulnerability enables unauthorized administrative command execution Custom malware payloads have been successfully deployed to affected systems; the malware family and full capabilities are not yet publicly detailed Exploitation has been ongoing for weeks prior to patch availability, indicating attackers maintained access during this window SonicWall has released patches; specific CVE identifiers and affected firmware versions are available through official SonicWall security advisories Attack vector and initial compromise method remain uncertain — confirm through vendor documentation before assuming your environment is affected IMPACT ...