VulnSocial
← Back to blog

CVE-2026-15409 – Critical SSRF in SonicWall SMA1000 Appliances

The CVE-2026-15409 vulnerability is a Critical server‑side request forgery (SSRF) flaw affecting SonicWall SMA1000 series appliances. It is listed in the CISA KEV catalog and has been observed under active exploitation since mid‑July 2026.

Key takeaways

  • Critical SSRF vulnerability (CVE-2026-15409) in SonicWall SMA1000 series.
  • Remote unauthenticated attacker can force the appliance to issue arbitrary network requests (CWE‑918).
  • Listed in CISA KEV and observed active exploitation since mid‑July 2026.
  • Immediate patch required; see SonicWall advisory (SNWLID‑2026‑0008).
  • Monitor outbound traffic for unusual SSRF patterns and isolate unpatched devices.

Overview

In early July 2026, SonicWall disclosed two zero‑day vulnerabilities in its SMA1000 line: CVE-2026-15409 (SSRF) and CVE-2026-15410 (privilege escalation). The SSRF flaw is remotely exploitable without authentication. The vulnerability was added to the CISA KEV catalog on 2026‑07‑14, and SonicWall released a hotfix (SNWLID‑2026‑0008) the same day.

Technical Details

The flaw resides in the Work Place interface's wsproxy endpoint. An unauthenticated attacker can supply a crafted URL that causes the appliance to issue an HTTP request to any address, bypassing network controls. This is classified as CWE‑918 (Server‑Side Request Forgery). The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, yielding a base score of 10.0 (Critical). Public PoC code appeared on July 15, and honeypot networks reported mass exploitation on July 16‑17, confirming the vulnerability is being leveraged in the wild.

Severity & Impact

With a Critical CVSS score of 10.0, the vulnerability enables an attacker to force the appliance to communicate with any network resource. This can lead to data leakage, internal network scanning, and, when chained with CVE-2026-15410, full remote code execution with root privileges.

Affected Products

The issue affects all SonicWall SMA1000 hardware, including the SMA6210, SMA7210, and SMA8200V models, across firmware versions prior to the July‑2026 hotfix (e.g., 12.4.3‑03245, 12.5.0‑02283). For a complete list of affected CPE entries and version numbers, see the CVE page.

Actionable Insights

  • Verify inventory of SMA1000 appliances and their firmware versions.
  • Prioritize patch for any device running a vulnerable firmware.
  • If patching cannot be done immediately, block inbound traffic to the wsproxy endpoint and restrict outbound connections from the appliance to trusted destinations only.
  • Deploy detection signatures for SSRF patterns: look for outbound HTTP requests to unusual internal IP ranges or external services initiated by the appliance.
  • Correlate logs with known IOCs (e.g., use of the “wsproxy” path) and with the threat feed from the CISA KEV catalog.
  • Use VulnSocial’s real‑time threat dashboard for up‑to‑date activity: https://vulnsocial.com/cve/CVE-2026-15409.

Remediation & Mitigation

  1. Patch: Apply SonicWall’s official hotfix (SNWLID‑2026‑0008) as described in the vendor advisory.
  2. Verify: Confirm the firmware version after patching; ensure the version is 12.4.3‑03434 or later (or the equivalent for each model).
  3. Isolate: Temporarily place unpatched devices in a segmented network with no internet egress.
  4. Monitor: Enable detailed logging of the wsproxy endpoint and alert on outbound connections to non‑whitelisted IPs.
  5. Apply: Follow CISA’s BOD 26‑04 guidance for prioritizing security updates and forensics triage.
  6. Review: Conduct a post‑remediation audit to ensure no residual compromise and to check for any chained exploitation using CVE‑2026‑15410.

References

Bottom Line

CVE‑2026‑15409 is a Critical SSRF flaw in SonicWall SMA1000 appliances that is already being weaponized at scale. Immediate patch and network‑level mitigations are required to stop active exploitation.

#CVE202615409 #Critical #SSRF #CISAKEV #SonicWall #SMA1000