CVE-2026-15409

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-15409 10.0

SonicWall · SMA1000 Appliances · Added 2026-07-14 · Published 2026-07-14

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilitySonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

VendorSonicWall

ProductSMA1000 Appliances

Date added2026-07-14

Due date2026-07-17

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-918

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Descriptions

KEV: SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.

NVD: A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-08-25 23:47 UTC

Wall time0.5s

Searches5

Component defaultunknown

Sources https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008
https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-sma1000-flaws-exploited-in-zero-day-attacks-patch-now/
https://www.helpnetsecurity.com/2026/07/14/sonicwall-sma-attacks-via-cve-2026-15409-cve-2026-15410/
https://github.com/tc4dy/CVE-2026-15409-15410-Framework
https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/
https://horizon3.ai/attack-research/vulnerabilities/cve-2026-15409-cve-2026-15410/
https://www.darkreading.com/vulnerabilities-threats/inc-ransomware-exploits-sonicwall-sma-zero-days

Hunting hypothesis agent

Hunt extraweb_access.log for /workplace/wsproxy?bmID=-3389* WebSocket upgrades (HTTP 101) to 127.0.0.1:1050 with UA 'SMA Connect Agent' from non-appliance IPs — exploit tunnels to Erlang, authenticates with hardcoded cookie, runs os:cmd/1.

Research details

ComponentWork Place interface — wsproxy endpoint accepting bmID parameter tunneled to internal Erlang distribution services (port 1050/8188), enabling SSRF-to-RCE chain

PreconditionsNetwork access (HTTPS, port 443) to the SMA1000 Work Place interface; no authentication required; target must be SMA 6210, SMA 7210, or SMA 8200v running affected firmware versions (12.4.3-03245 through 12.4.3-03434 or 12.5.0-02283 through 12.5.0-02800). Chained with CVE-2026-15410 for full root compromise. agent

DeliveryNetwork (HTTPS, port 443); unauthenticated SSRF via wsproxy endpoint bmID parameter tunnels to internal Erlang node on port 1050/8188, authenticates with hardcoded cookie '10ecad5b446e86864832904cd439b6b70262', achieves RCE via os:cmd/1, then chains CVE-2026-15410 path traversal through AMC remove_hotfix endpoint (wss://host/workplace/wsproxy?bmID=-3389*...&port=8188) for root privilege escalation.

Public PoCyes

PoC URLs https://github.com/tc4dy/CVE-2026-15409-15410-Framework Third-party repos; verify before use.

Advisoryhttps://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008

Exploit notesThe tc4dy/CVE-2026-15409-15410-Framework GitHub repo (5 stars, 4 forks) provides a full weaponized Python exploit (958 lines) and a safe detection checker. The exploit establishes a WebSocket to wsproxy with bmID=-3389{hex}&serviceType=SSH&host=127.0.0.1&port=1050, performs an Erlang distribution handshake authenticating with the hardcoded default cookie 10ecad5b446e86864832904cd439b6b70262, then calls os:cmd/1 for RCE. The CVE-2026-15410 privesc writes a shell script to /var/tmp/ and triggers AMC remove_hotfix XML-RPC with ../../../../var/tmp/script.sh path traversal to port 8188. Actively exploited as zero-day since June 22, 2026 per Volexity and HelpNetSecurity. CVSS attack complexity: LOW | CRITICAL severity (CVSS 10.0).

SummarySonicWall SMA1000 appliances (SMA 6210, SMA 7210, SMA 8200v) contain a critical server-side request forgery (SSRF) vulnerability (CWE-918) in the Work Place interface wsproxy endpoint. An unauthenticated remote attacker can exploit the SSRF to tunnel through to internal Erlang distribution services on port 1050/8188 using a bmID parameter, authenticate to the Erlang node with a hardcoded default cookie, and execute arbitrary OS commands via os:cmd/1. Chaining with CVE-2026-15410 (AMC path traversal) achieves root privilege escalation. A full weaponized exploit framework is publicly available on GitHub. The vulnerability was exploited as a zero-day since June 22, 2026 before SonicWall's July 14, 2026 disclosure.

Tia coverage

First reported2026-07-15

First exploit report2026-07-16

Exploit report → KEV2 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

a-uk-council-breach-reported-in-july-turned-out-to-be-one-of-man sonicwall-sma1000-two-zero-day-flaws-under-active-exploitation-c

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.