CVE-2026-15410

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-15410 7.2

SonicWall · SMA1000 Appliances · Added 2026-07-14 · Published 2026-07-14

3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilitySonicWall SMA1000 Appliances Code Injection Vulnerability

VendorSonicWall

ProductSMA1000 Appliances

Date added2026-07-14

Due date2026-07-17

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-94

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.

NVD: Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-08-25 23:47 UTC

Wall time0.5s

Searches5

Component defaultunknown

Sources https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008
https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-sma1000-flaws-exploited-in-zero-day-attacks-patch-now/
https://www.helpnetsecurity.com/2026/07/14/sonicwall-sma-attacks-via-cve-2026-15409-cve-2026-15410/
https://github.com/tc4dy/CVE-2026-15409-15410-Framework
https://github.com/HORKimhab/CVE-2026-15410
https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/
https://www.rapid7.com/blog/post/etr-rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410/

Hunting hypothesis agent

Hunt ctrl-service.log for 'running hotfix removal for:' with ../../ traversal to /var/tmp/ — PoC writes privesc.sh then calls remove_hotfix via port 8188 XML-RPC with ../../../../var/tmp/privesc.sh; correlate wsproxy bmID=-3389privesc.

Research details

ComponentAppliance Management Console (AMC) sysCtrl.execRemoveHotfix XML-RPC method — path traversal in /usr/local/bin/remove_hotfix helper allows execution of arbitrary scripts as root

PreconditionsNetwork access to the SMA1000 AMC XML-RPC service on port 8188 (reachable via CVE-2026-15409 wsproxy SSRF tunnel); authenticated administrative session or access to the internal control service via the SSRF chain; target must be SMA 6210, SMA 7210, or SMA 8200v running firmware 12.4.3-03245 through 12.4.3-03434 or 12.5.0-02283 through 12.5.0-02800. In the wild chain, CVE-2026-15409 provides the initial unauthenticated SSRF to reach port 8188, and CouchDB credentials (admin:admin) or product_uuid-derived auth enables the sysCtrl call. agent

DeliveryNetwork (XML-RPC over HTTPS via CVE-2026-15409 wsproxy tunnel to port 8188); authenticated sysCtrl.execRemoveHotfix call with path traversal payload (e.g. ../../../../tmp/script.sh) passes unsanitized input to /usr/local/bin/remove_hotfix, which chmod+exec's the traversed path as root.

Public PoCyes

PoC URLs https://github.com/tc4dy/CVE-2026-15409-15410-Framework
https://github.com/HORKimhab/CVE-2026-15410 Third-party repos; verify before use.

Advisoryhttps://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008

Exploit notesThe tc4dy/CVE-2026-15409-15410-Framework provides the full weaponized chain: after CVE-2026-15409 SSRF achieves RCE via Erlang os:cmd/1, the --privesc flag writes a shell script to /var/tmp/ and calls sysCtrl.execRemoveHotfix with path traversal (../../../../var/tmp/script.sh) through the AMC XML-RPC on port 8188, executing the script as root via /usr/local/bin/remove_hotfix. The HORKimhab/CVE-2026-15410 repo (0 stars, template-based) contains only a conceptual PoC that brute-forces AMC endpoints without confirmed success — it is not weaponized. Volexity's IR confirmed the remove_hotfix path traversal was used in real attacks since June 22, 2026; ctrl-service.log shows entries like 'running hotfix removal for:../../../../../tmp/1234.sh'. CVSS attack complexity: LOW | HIGH severity (CVSS 7.2).

SummarySonicWall SMA1000 appliances (SMA 6210, SMA 7210, SMA 8200v) contain a post-authentication code injection vulnerability (CWE-94) in the Appliance Management Console (AMC) sysCtrl.execRemoveHotfix XML-RPC method. The /usr/local/bin/remove_hotfix helper constructs a rollback path from caller-controlled input without sufficient path sanitization, allowing ../../ traversal to execute arbitrary scripts as root. When chained with CVE-2026-15409 (SSRF), an unauthenticated attacker achieves full root compromise: the SSRF tunnels to port 8188, and the execRemoveHotfix call with a path like ../../../../var/tmp/script.sh executes a staged payload as root. Actively exploited as a zero-day since June 22, 2026 by threat actor UTA0533 per Volexity.

Tia coverage

First reported2026-07-15

First exploit report2026-07-16

Exploit report → KEV2 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

sonicwall-sma1000-two-zero-day-flaws-under-active-exploitation-c

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.