The Chain That Opened the Crisis: How SonicWall SMA1000’s First Zero-Day Turned VPN Appliances Into MFA Harvesting Machines

The SonicWall SMA1000 crisis began on June 22, 2026, with two vulnerabilities: CVE-2026-15409 and CVE-2026-15410. While the second chain received more public attention, the first chain established the operational playbook for the summer. It demonstrated how a…