~/f4n6 $ grep -r "CVE-2026-15409 — SonicWall SMA1000 Appliances: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability" ./investigations/ --include="*.md"

CVE-2026-15409 — SonicWall SMA1000 Appliances: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

Jeff Davies 14 Jul 2026 6 min read

1. Executive summary

SonicWall has disclosed and patched CVE-2026-15409, a CVSS 10.0 CRITICAL server-side request forgery (SSRF) vulnerability (CWE-918) in the SMA1000 Appliance Work Place interface. The flaw permits a remote, unauthenticated attacker to force the appliance to make requests to unintended locations. SonicWall reports the vulnerability is being actively exploited in the wild alongside a related code injection flaw (CVE-2026-15410); the CVE is NOT currently listed in CISA KEV. EMEA financial services organisations exposing SMA1000 appliances — particularly internet-facing units — face immediate risk of unauthenticated network pivoting and potential appliance compromise.

2. Regulatory framing

Article Trigger (the fact in this item) Practical impact
DORA Art. 17: ICT-related incident management process Active exploitation of a CVSS 10.0 vulnerability in a perimeter security appliance. Organisations must invoke incident management processes to detect, contain, and remediate.
DORA Art. 18: classification of ICT-related incidents and cyber threats A critical unauthenticated SSRF in a security gateway with confirmed in-the-wild exploitation. The incident likely meets classification thresholds for a major ICT-related incident.
DORA Art. 19: reporting of major ICT-related incidents to competent authorities If exploitation is confirmed on a financial entity's appliance, a major incident report may be due. Assess reporting timelines immediately upon detection of compromise.
DORA Art. 24: digital operational resilience testing — general requirements SMA1000 appliances are internet-facing perimeter security components. Vulnerability scanning and patching of externally exposed assets must be prioritised under resilience testing programmes.
NIS2 Art. 21(2)(d): supply chain security measures The vulnerability is in a third-party vendor security product (SonicWall). Supply chain risk assessments must account for this critical flaw in vendor-provided perimeter infrastructure.
NIS2 Art. 23: incident reporting obligations Active exploitation of a critical vulnerability may constitute a significant incident under NIS2. In-scope entities must prepare early and incident notifications per national transposition timelines.
UK NIS 2018: UK Network and Information Systems Regulations — OES/RDSP duties Critical perimeter appliance vulnerability with active exploitation. OES and RDSP operators should assess whether this triggers incident reporting obligations to the NCSC/supervisory authority.

3. Technical analysis & attack chain

Affected products and versions (from NVD/CNA data)

  • SonicWall SMA1000 (Linux platform)
  • 12.4.3-03245 through 12.4.3-03434 — affected
  • 12.5.0-02283 through 12.5.0-02800 — affected

Vulnerability mechanism

The SSRF resides in the SMA1000 Appliance Work Place interface. A remote, unauthenticated attacker can craft requests that cause the appliance to initiate outbound connections to attacker-controlled or unintended destinations. No authentication is required, which accounts for the CVSS 10.0 rating.

Confirmed attack chain

  1. Reconnaissance — The attacker identifies an internet-facing SonicWall SMA1000 appliance running a vulnerable firmware version (12.4.3-03245–03434 or 12.5.0-02283–02800) by fingerprinting the Work Place interface.
  2. Initial access via SSRF — The attacker sends a crafted HTTP request to the Work Place interface, exploiting CVE-2026-15409. No credentials are required. The appliance is coerced into making outbound requests to an attacker-specified location.
  3. Potential pivoting — The SSRF may be used to interact with internal services reachable from the appliance's perspective, retrieve responses, or chain with the companion vulnerability CVE-2026-15410 (a code injection requiring authenticated administrator access — CVSS and severity not specified in verified reference data) to achieve arbitrary OS command execution.

Companion vulnerability context (CVE-2026-15410)

SonicWall simultaneously patched CVE-2026-15410, a code injection vulnerability in the same SMA1000 product line. This flaw requires a remote authenticated attacker with administrator privileges to execute arbitrary OS commands under specific conditions. The combination of an unauthenticated SSRF (CVE-2026-15409) and an authenticated code injection (CVE-2026-15410) suggests a potential chaining scenario, though the specific chain from SSRF to administrator-level code execution is not explicitly documented in the source material.

Active exploitation

Help Net Security reports that both CVE-2026-15409 and CVE-2026-15410 are being actively exploited in zero-day attacks. This is a single-sourced claim (Help Net Security, corroborating SonicWall's advisory language urging customers to search for evidence of compromise) — verify before enforcement if relying on the exploitation claim for regulatory reporting.

Attribution

No threat actor attribution is provided in any source material. No MITRE ATT&CK actor profile is available. Attribution is unconfirmed.

Observed impact and remediation guidance from vendor

SonicWall advises that if IOCs are present, organisations should:

  • Re-image hardware appliances or re-deploy virtual appliances.
  • Change all user and administrator passwords.
  • Reset TOTP tokens.

No specific IOCs, file paths, registry keys, command-line artefacts, or malware family names have been published in the available source material.

4. Mitigation & containment

P1 — Within 24 hours

  1. Inventory and assess exposure: Identify all SonicWall SMA1000 appliances in the estate. Determine firmware versions. Any appliance running 12.4.3-03245 through 12.4.3-03434 or 12.5.0-02283 through 12.5.0-02800 is vulnerable.
  2. Restrict internet exposure: Where possible, remove SMA1000 appliances from internet-facing positions or place behind additional access controls (IP allowlisting, WAF rules filtering SSRF patterns to the Work Place interface). If the appliance does not require internet exposure, disable external access immediately.
  3. Apply vendor firmware update: Upgrade to a fixed firmware version as published in SonicWall PSIRT advisory SNWLID-2026-0008 (https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008). Do not delay patching pending forensic review if the appliance is internet-facing.
  4. Block outbound traffic from SMA appliances: Apply egress filtering at the network level to restrict the SMA1000 appliance's ability to make arbitrary outbound connections, mitigating SSRF impact. Allow only required destinations (e.g., SonicWall licensing/update servers, required authentication backends).

P2 — Within 72 hours

  1. Forensic triage: Examine SMA1000 appliances for evidence of compromise. SonicWall's advisory (via Help Net Security) recommends searching for IOCs; however, no specific IOCs have been published in the available source material. Monitor SonicWall PSIRT advisory SNWLID-2026-0008 for updated IOC lists.
  2. If compromise is suspected or confirmed: - Re-image hardware appliances from a known-good image. - Re-deploy virtual appliances from clean templates. - Change all user and administrator passwords. - Reset all TOTP tokens.
  3. Review access logs: Examine SMA1000 logs for anomalous outbound requests originating from the Work Place interface, which may indicate SSRF exploitation.
  4. Assess CVE-2026-15410 exposure: Verify whether administrator accounts on SMA1000 appliances show signs of compromise or anomalous activity, given the companion code injection vulnerability.

P3 — Within 7 days

  1. Validate patch deployment: Confirm all SMA1000 appliances are running fixed firmware across the entire estate, including DR sites and backup appliances.
  2. Update asset management and risk registers: Record the vulnerability, remediation status, and any incident response actions taken.
  3. Review DORA/NIS2 reporting obligations: If exploitation was confirmed on a financial entity's appliance, assess whether a major ICT-related incident report is required under DORA Art. 19 or NIS2 Art. 23.

5. Indicators of compromise

No indicators of compromise available in the source material. SonicWall's advisory references IOCs but none have been published in the provided sources. Monitor https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008 for updates.

6. Detection

Insufficient indicators to author detection rules. No file hashes, distinctive strings, command-line artefacts, registry keys, mutex names, or network indicators are present in the available source material. Detection should focus on:

  • Monitoring SMA1000 appliance logs for anomalous outbound HTTP/HTTPS requests originating from the Work Place interface.
  • Alerting on unexpected egress connections from SMA1000 appliance IP addresses.
  • Reviewing authentication logs for anomalous administrator session activity (relevant to CVE-2026-15410 chaining).

CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

CVE CVSS Exploited EPSS Summary
CVE-2026-15409 10.0 Critical — — A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote…

7. Sources

  • NVD, CVE-2026-15409 Detail, https://nvd.nist.gov/vuln/detail/CVE-2026-15409, published 2026-07-14
  • SonicWall PSIRT, SNWLID-2026-0008, https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008 (referenced in NVD)
  • Help Net Security, "SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410)", https://www.helpnetsecurity.com/2026/07/14/sonicwall-sma-attacks-via-cve-2026-15409-cve-2026-15410/, published 2026-07-14
  • NVD, CVE-2026-15410 Detail, https://nvd.nist.gov/vuln/detail/CVE-2026-15410 (context on companion vulnerability)

8. Adverse Trace position

CVE-2026-15409 is a maximum-severity (CVSS 10.0 CRITICAL) unauthenticated SSRF in SonicWall SMA1000 appliances with confirmed active exploitation reported by SonicWall and Help Net Security, though the exploitation claim is single-sourced and should be verified before being used as a basis for regulatory incident reporting. The vulnerability is NOT yet in CISA KEV. EMEA financial services clients with internet-facing SMA1000 appliances running firmware 12.4.3-03245–03434 or 12.5.0-02283–02800 should treat this as an immediate P1 remediation: apply the vendor fix, restrict egress, and triage for compromise. If compromise is confirmed, follow SonicWall's re-image/re-deploy guidance and assess DORA Art. 19 and NIS2 Art. 23 reporting obligations. Adverse Trace will monitor for published IOCs and updated vendor guidance, and will issue a follow-up advisory if exploitation scope expands or concrete indicators become available.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.

Post this to LinkedIn
Formatting is converted automatically — headings, bullets, a link back & hashtags. Paste straight in.
J
Jeff Davies