CVE-2026-15410 – High Code Injection in SonicWall SMA1000 Appliances

Key Takeaways

• Severity: High (CVSS 7.2)
• Impact: Authenticated admin can execute arbitrary OS commands (code injection) on SMA1000 appliances.
• Affected: SonicWall SMA6210, SMA7210, SMA8200V (multiple firmware versions).
• Action: Apply the vendor patch (SNWLID‑2026‑0008) immediately; review admin credentials and monitor for exploitation.

Overview

The SonicWall Secure Mobile Access (SMA) 1000 Series appliances contain a post‑authentication code‑injection flaw (CWE‑94) in the Appliance Management Console (AMC). An attacker who has valid administrator credentials can craft a request that triggers uncontrolled code generation, allowing arbitrary OS command execution on the underlying appliance. The vulnerability is cataloged in the CISA KEV list, confirming that it is being actively exploited in the wild.

Technical Details

• Vulnerability type: Improper control of generation of code (code injection) – CWE‑94.
• Attack vector: Network‑accessible management console; requires authenticated admin (PR:H).
• CVSS v3.1 vector: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H – score 7.2 (High).
• Exploitation flow: Threat actors have been observed using the unauthenticated SSRF bug CVE‑2026‑15409 to gain a foothold, then chaining to CVE‑2026‑15410 to execute commands with root privileges.
• Observed activity: The vulnerability entered the CISA KEV catalog on 2026‑07‑14 and has been reported as actively exploited daily since then (see the VulnSocial timeline for details).

Severity & Impact

Affected Products

The flaw affects the following SonicWall SMA1000 series devices and firmware releases:

• SMA6210, SMA7210, SMA8200V appliances.
• Firmware versions 12.4.3‑03245, 12.4.3‑03387, 12.4.3‑03434, 12.5.0‑02283, 12.5.0‑02624, 12.5.0‑02800.

For the exhaustive list of CPE entries and version ranges, see the VulnSocial CVE page.

What to Do Now

1. Deploy the vendor patch (SNWLID‑2026‑0008) on every SMA1000 appliance.
2. Verify firmware version – ensure the device is running a version newer than the listed vulnerable releases.
3. Harden admin access – rotate administrator passwords, enable multi‑factor authentication, and restrict console access to trusted networks.
4. Monitor for exploitation – watch for unusual AMC login activity, unexpected command execution, or outbound connections from the appliance. Correlate with indicators of compromise (IOCs) from the CVE‑2026‑15409 exploit chain.
5. Leverage threat intel – track live activity and signal trends on the VulnSocial CVE page for new IOCs or exploit code releases.

Remediation & Mitigation

• Patch: Apply the SonicWall advisory update (see References).
• Configuration: Disable unnecessary management services, enforce strong password policies, and segment the SMA appliances from the internet.
• Detection: Deploy IDS/IPS signatures that detect the AMC request patterns used by the exploit; consider using community detection templates referenced in the VulnSocial timeline.
• Incident response: If compromise is suspected, isolate the appliance, capture console logs, and perform a forensic analysis of executed commands.

Bottom Line

CVE-2026-15410 is a High‑severity code‑injection flaw in SonicWall SMA1000 appliances that is actively exploited. Immediate deployment of the vendor patch, credential hygiene, and continuous monitoring are essential to prevent full‑system compromise.

References

• Vendor advisory (SNWLID‑2026‑0008): https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008
• CISA Known Exploited Vulnerabilities entry: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15410
• VulnSocial CVE details: https://vulnsocial.com/cve/CVE-2026-15410
• VulnSocial home page: https://vulnsocial.com

#CVE202615410 #CVE #High #SonicWall #CISAKEV #CodeInjection