Vulnerability-Lookup

CVE-2026-15409 (GCVE-0-2026-15409)

Vulnerability from cvelistv5 – Published: 2026-07-14 19:39 – Updated: 2026-08-04 03:56

CISA Previdian

Summary

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.

Severity

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: active Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-14 00:00 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

sonicwall mitre root Scorecard

References

2 references

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

1 product

Vendor	Product	Version
SonicWall	SMA1000	Affected: 12.4.3-03245 , ≤ 12.4.3-03434 (custom) Affected: 12.5.0-02283 , ≤ 12.5.0-02800 (custom)

Date Public

2026-07-14 19:40

Credits

Adam Babis of SonicWall PSIRT

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: f6099d50-ec4a-489b-a1aa-a2f6520844a3

Vulnerability ID: CVE-2026-15409

Status: Confirmed

Status Updated: 2026-07-14 02:00 CEST

Exploited: Yes

Timestamps

First Seen: 2026-07-14

Asserted: 2026-07-14

Scope

Notes: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability | Affected: SonicWall / SMA1000 Appliances | Description: SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-07-17 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-15409

Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details

Cwes	CWE-918
Feed	CISA Known Exploited Vulnerabilities Catalog
Product	SMA1000 Appliances
Due Date	2026-07-17
Date Added	2026-07-14
Vendorproject	SonicWall
Vulnerabilityname	SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
Knownransomwarecampaignuse	Known

References

CVE-2026-15409

Created: 2026-10-02 08:09 CEST | Updated: 2026-10-02 08:09 CEST

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 6225d6c8-8865-41cf-870a-a5df663890c4

Vulnerability ID: CVE-2026-15409

Status: Confirmed

Status Updated: 2026-07-14 20:18 CEST

Exploited: Yes

Timestamps

First Seen: 2026-07-14

Asserted: 2026-07-14

Scope

Notes: A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated... | Affected: SonicWall / SMA1000 | CVSS: 10.0 (CRITICAL) | EPSS: 0.06795 | Used in malware: unknown | Listed 1 hour ahead of CISA KEV | Not yet in CISA KEV: False

Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: previdian

Details

Feed	Previdian (previdian.com)
Title	A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated...
Cve Id	CVE-2026-15409
Vendor	SonicWall
Ghsa Id	None
Product	SMA1000
Added Date	2026-07-14T18:18:00.000Z
Cvss Score	10.0
Epss Score	0.06795
Previous Ids
Cvss Severity	CRITICAL
Virtual Patch	True
Cvss Estimated	False
Epss Percentile	0.938
Used In Malware	unknown
Vulnerability Id	CVE-2026-15409
Ahead Of Cisa Kev	`{ "count": 1, "unit": "hour" }`
Not Yet In Cisa Kev	False

References

Created: 2026-10-02 09:09 CEST | Updated: 2026-10-02 09:09 CEST

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 10,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-15409",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-14T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-07-14",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-04T03:56:14.089Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux"
          ],
          "product": "SMA1000",
          "vendor": "SonicWall",
          "versions": [
            {
              "lessThanOrEqual": "12.4.3-03434",
              "status": "affected",
              "version": "12.4.3-03245",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.5.0-02800",
              "status": "affected",
              "version": "12.5.0-02283",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Adam Babis of SonicWall PSIRT"
        }
      ],
      "datePublic": "2026-07-14T19:40:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location."
            }
          ],
          "value": "A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T19:43:54.725Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0008",
        "discovery": "INTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-15409",
    "datePublished": "2026-07-14T19:39:34.808Z",
    "dateReserved": "2026-07-10T14:12:14.377Z",
    "dateUpdated": "2026-08-04T03:56:14.089Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-15409",
      "date": "2026-10-02",
      "epss": "0.06795",
      "percentile": "0.93807"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unknown",
                "platforms": [
                  "Linux"
                ],
                "product": "SMA1000",
                "vendor": "SonicWall",
                "versions": [
                  {
                    "lessThanOrEqual": "12.4.3-03434",
                    "status": "affected",
                    "version": "12.4.3-03245",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "12.5.0-02800",
                    "status": "affected",
                    "version": "12.5.0-02283",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "PSIRT@sonicwall.com"
          }
        ],
        "cisaActionDue": "2026-07-17",
        "cisaExploitAdd": "2026-07-14",
        "cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset\u0027s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
        "cisaVulnerabilityName": "SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability",
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03245:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7F861049-5B88-4E18-A0E7-D1E2BC7A4342",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03387:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E4A6CA48-E2D9-4F18-8FC8-B1EE7F51789C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03434:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EBCE7761-8416-4942-B0BD-426EFC73B57C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02283:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CE23BD37-4112-407F-9E34-04CB5A4DA996",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02624:*:*:*:*:*:*:*",
                    "matchCriteriaId": "95E3313E-0647-40ED-9848-5AC01188A84F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02800:*:*:*:*:*:*:*",
                    "matchCriteriaId": "75F6B9CE-73E4-42BE-9CE1-FD79255CDD0B",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:sonicwall:sma6210:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7B24D300-1154-49A1-A1F3-FB0CC717166A",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03245:*:*:*:*:*:*:*",
                    "matchCriteriaId": "55CD7766-9F2D-450D-A878-AA1522E8FF68",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03387:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EAF12D10-FA8F-471E-B008-68E0E29089C6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03434:*:*:*:*:*:*:*",
                    "matchCriteriaId": "79920402-165D-4D81-BFD2-9F679A48671A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.5.0-02283:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6842E4D7-BEDA-41FB-AEC3-CEB3692374C2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.5.0-02624:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6AF4557F-ABAF-4795-915A-695383F64EEB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.5.0-02800:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9459507A-A2C8-400D-8669-E8ADBDE61DE0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:sonicwall:sma7210:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E9B414C5-C376-4216-A267-ABC0930905CE",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.4.3-03245:*:*:*:*:*:*:*",
                    "matchCriteriaId": "571C9CA1-F660-4479-9E91-B3B1714A2090",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.4.3-03387:*:*:*:*:*:*:*",
                    "matchCriteriaId": "58706C99-B77F-4AE5-BD45-EBA65DEE2485",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.4.3-03434:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9E698DFA-1684-43E3-9964-0E207A7A2CC1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.5.0-02283:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F2F44543-2404-4CDF-9D2F-1B851660F5D5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.5.0-02624:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1E14F40F-4AA1-42B4-998E-AC965FBBE519",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.5.0-02800:*:*:*:*:*:*:*",
                    "matchCriteriaId": "43197E99-0500-4971-8A66-4E70F8138289",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:sonicwall:sma8200v:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "653B5F4D-7417-4A85-B385-46157A1540A6",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location."
          }
        ],
        "id": "CVE-2026-15409",
        "lastModified": "2026-07-16T05:16:18.293",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 10.0,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 6.0,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-15409",
                "options": [
                  {
                    "exploitation": "active"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-14T00:00:00+00:00",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-14T20:16:56.783",
        "references": [
          {
            "source": "PSIRT@sonicwall.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "US Government Resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409"
          }
        ],
        "sourceIdentifier": "PSIRT@sonicwall.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-918"
              }
            ],
            "source": "PSIRT@sonicwall.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "HIGH",
                  "baseScore": 10,
                  "baseSeverity": "CRITICAL",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "NONE",
                  "scope": "CHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-15409",
                    "options": [
                      {
                        "Exploitation": "active"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-15T13:59:40.589269Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              },
              {
                "other": {
                  "content": {
                    "dateAdded": "2026-07-14",
                    "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409"
                  },
                  "type": "kev"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-14T20:09:22.958Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "government-resource"
                ],
                "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unknown",
              "platforms": [
                "Linux"
              ],
              "product": "SMA1000",
              "vendor": "SonicWall",
              "versions": [
                {
                  "lessThanOrEqual": "12.4.3-03434",
                  "status": "affected",
                  "version": "12.4.3-03245",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "12.5.0-02800",
                  "status": "affected",
                  "version": "12.5.0-02283",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Adam Babis of SonicWall PSIRT"
            }
          ],
          "datePublic": "2026-07-14T19:40:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location."
                }
              ],
              "value": "A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-918",
                  "description": "CWE-918: Server-Side Request Forgery (SSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-14T19:43:54.725Z",
            "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
            "shortName": "sonicwall"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008"
            }
          ],
          "source": {
            "advisory": "SNWLID-2026-0008",
            "discovery": "INTERNAL"
          },
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "assignerShortName": "sonicwall",
        "cveId": "CVE-2026-15409",
        "datePublished": "2026-07-14T19:39:34.808Z",
        "dateReserved": "2026-07-10T14:12:14.377Z",
        "dateUpdated": "2026-08-04T03:56:14.089Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

BDU:2026-09726 (CVE-2026-15409)

Vulnerability from fstec – Published: 2026-07-15 – Updated: 2026-07-15 – View on bdu.fstec.ru Exploit exists Yes Fixed

CISA Previdian

Title

Уязвимость интерфейса Appliance Work Place микропрограммного обеспечения межсетевых экранов SonicWall серии SMA 1000, позволяющая нарушителю осуществить SSRF-атаку

Summary

Уязвимость интерфейса Appliance Work Place микропрограммного обеспечения межсетевых экранов SonicWall серии SMA 1000 связана с недостаточной проверкой запросов на стороне сервера. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, осуществить SSRF-атаку

Severity

10.0 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:C/I:C/A:C

10.0 (Critical) CVSS 3.1


                      
                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Spoofing

Incidents

Yes

Remediation

Software update

CWE

CWE-918 - Серверная фальсификация запросов

Aliases

CVE-2026-15409

References

4 references

URL
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409
https://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv

Impacted products

1 product from 1 vendor

Vendors

SonicWall

Products

SMA 1000

Versions

до 12.4.3-03245 включительно (SMA 1000), до 12.4.3-03387 включительно (SMA 1000), до 12.4.3-03434 включительно (SMA 1000), до 12.5.0-02283 включительно (SMA 1000), до 12.5.0-02624 включительно (SMA 1000), до 12.5.0-02800 включительно (SMA 1000)

Product types

Network appliance software

Mitigations

Использование рекомендаций производителя: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "SonicWall",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 12.4.3-03245 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (SMA 1000), \u0434\u043e 12.4.3-03387 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (SMA 1000), \u0434\u043e 12.4.3-03434 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (SMA 1000), \u0434\u043e 12.5.0-02283 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (SMA 1000), \u0434\u043e 12.5.0-02624 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (SMA 1000), \u0434\u043e 12.5.0-02800 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (SMA 1000)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "14.07.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "15.07.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "15.07.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-09726",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2026-15409",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "SMA 1000",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 Appliance Work Place \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u044d\u043a\u0440\u0430\u043d\u043e\u0432 SonicWall \u0441\u0435\u0440\u0438\u0438 SMA 1000, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c SSRF-\u0430\u0442\u0430\u043a\u0443",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0421\u0435\u0440\u0432\u0435\u0440\u043d\u0430\u044f \u0444\u0430\u043b\u044c\u0441\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 (CWE-918)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 Appliance Work Place \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u044d\u043a\u0440\u0430\u043d\u043e\u0432 SonicWall \u0441\u0435\u0440\u0438\u0438 SMA 1000 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c SSRF-\u0430\u0442\u0430\u043a\u0443",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041f\u043e\u0434\u043c\u0435\u043d\u0430 \u043f\u0440\u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008\nhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog\nhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409\nhttps://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u041e \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-918",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 10)\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 10)"
}

CERTFR-2026-ALE-006

Vulnerability from certfr_alerte - Published: 2026-07-15 - Updated: 2026-08-24

Le 14 juillet 2026, Sonicwall a publié un avis de sécurité concernant deux vulnérabilités affectant les Secure Mobile Access (SMA) 1000.

La vulnérabilité critique CVE-2026-15409 permet une falsification de requêtes côté serveur (SSRF) de la part d'un attaquant non authentifié.

La vulnérabilité CVE-2026-15410 permet à un attaquant authentifié avec les droits administrateur d'exécuter du code arbitraire à distance.

L'éditeur indique que ces deux vulnérabilités sont activement exploitées, sans préciser s'il est possible pour un attaquant non authentifié de chaîner l'exploitation de ces deux vulnérabilités pour prendre la main sur l'équipement.

Cependant, Sonicwall fournit des indicateurs de compromission à rechercher. En cas de présence de l'un de ceux-ci dans les journaux mentionnés dans l'avis de l'éditeur, l'application des correctifs n'est pas suffisante. En effet, celui-ci recommande alors de :

réinstaller le système ;
changer tous les mots de passe utilisateurs et administrateurs ;
réinitialiser les mots de passe à usage unique basé sur le temps (TOTP, Time based One Time Password).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Sonicwall	Secure Mobile Access	Modèles SMA1000 6210, 7210 et 8200v versions 12.5.x antérieures à 12.5.0-02835
	Sonicwall	Secure Mobile Access	Modèles SMA1000 6210, 7210 et 8200v versions antérieures à 12.4.3-03453

References

Title

Publication Time

CERTFR-2026-AVI-0875

Vulnerability from certfr_avis - Published: 2026-07-15 - Updated: 2026-07-15

De multiples vulnérabilités ont été découvertes dans Sonicwall Secure Mobile Access 1000. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et une falsification de requêtes côté serveur (SSRF).

L'éditeur indique que les vulnérabilités CVE-2026-15409 et CVE-2026-15410 sont activement exploitées.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Sonicwall	Secure Mobile Access	Modèles SMA1000 6210, 7210 et 8200v versions 12.5.x antérieures à 12.5.0-02835
	Sonicwall	Secure Mobile Access	Modèles SMA1000 6210, 7210 et 8200v versions antérieures à 12.4.3-03453

References

Title

Publication Time

EUVD-2026-344017

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 07:55

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T07:55:54.146153+00:00",
  "id": "EUVD-2026-344017"
}

FKIE_CVE-2026-15409

Vulnerability from fkie_nvd - Published: 2026-07-14 20:16 - Updated: 2026-07-16 05:16

CISA Previdian

Severity

10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Summary

References

	URL	Tags
	PSIRT@sonicwall.com	https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008	Vendor Advisory
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409	US Government Resource

Impacted products

Vendor	Product	Version
sonicwall	sma6210_firmware	12.4.3-03245
sonicwall	sma6210_firmware	12.4.3-03387
sonicwall	sma6210_firmware	12.4.3-03434
sonicwall	sma6210_firmware	12.5.0-02283
sonicwall	sma6210_firmware	12.5.0-02624
sonicwall	sma6210_firmware	12.5.0-02800
sonicwall	sma6210	-
sonicwall	sma7210_firmware	12.4.3-03245
sonicwall	sma7210_firmware	12.4.3-03387
sonicwall	sma7210_firmware	12.4.3-03434
sonicwall	sma7210_firmware	12.5.0-02283
sonicwall	sma7210_firmware	12.5.0-02624
sonicwall	sma7210_firmware	12.5.0-02800
sonicwall	sma7210	-
sonicwall	sma8200v	12.4.3-03245
sonicwall	sma8200v	12.4.3-03387
sonicwall	sma8200v	12.4.3-03434
sonicwall	sma8200v	12.5.0-02283
sonicwall	sma8200v	12.5.0-02624
sonicwall	sma8200v	12.5.0-02800
sonicwall	sma8200v	-

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux"
          ],
          "product": "SMA1000",
          "vendor": "SonicWall",
          "versions": [
            {
              "lessThanOrEqual": "12.4.3-03434",
              "status": "affected",
              "version": "12.4.3-03245",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "12.5.0-02800",
              "status": "affected",
              "version": "12.5.0-02283",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "PSIRT@sonicwall.com"
    }
  ],
  "cisaActionDue": "2026-07-17",
  "cisaExploitAdd": "2026-07-14",
  "cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset\u0027s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
  "cisaVulnerabilityName": "SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03245:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F861049-5B88-4E18-A0E7-D1E2BC7A4342",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03387:*:*:*:*:*:*:*",
              "matchCriteriaId": "E4A6CA48-E2D9-4F18-8FC8-B1EE7F51789C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03434:*:*:*:*:*:*:*",
              "matchCriteriaId": "EBCE7761-8416-4942-B0BD-426EFC73B57C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02283:*:*:*:*:*:*:*",
              "matchCriteriaId": "CE23BD37-4112-407F-9E34-04CB5A4DA996",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02624:*:*:*:*:*:*:*",
              "matchCriteriaId": "95E3313E-0647-40ED-9848-5AC01188A84F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02800:*:*:*:*:*:*:*",
              "matchCriteriaId": "75F6B9CE-73E4-42BE-9CE1-FD79255CDD0B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sonicwall:sma6210:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7B24D300-1154-49A1-A1F3-FB0CC717166A",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03245:*:*:*:*:*:*:*",
              "matchCriteriaId": "55CD7766-9F2D-450D-A878-AA1522E8FF68",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03387:*:*:*:*:*:*:*",
              "matchCriteriaId": "EAF12D10-FA8F-471E-B008-68E0E29089C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03434:*:*:*:*:*:*:*",
              "matchCriteriaId": "79920402-165D-4D81-BFD2-9F679A48671A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.5.0-02283:*:*:*:*:*:*:*",
              "matchCriteriaId": "6842E4D7-BEDA-41FB-AEC3-CEB3692374C2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.5.0-02624:*:*:*:*:*:*:*",
              "matchCriteriaId": "6AF4557F-ABAF-4795-915A-695383F64EEB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:sonicwall:sma7210_firmware:12.5.0-02800:*:*:*:*:*:*:*",
              "matchCriteriaId": "9459507A-A2C8-400D-8669-E8ADBDE61DE0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sonicwall:sma7210:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E9B414C5-C376-4216-A267-ABC0930905CE",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.4.3-03245:*:*:*:*:*:*:*",
              "matchCriteriaId": "571C9CA1-F660-4479-9E91-B3B1714A2090",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.4.3-03387:*:*:*:*:*:*:*",
              "matchCriteriaId": "58706C99-B77F-4AE5-BD45-EBA65DEE2485",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.4.3-03434:*:*:*:*:*:*:*",
              "matchCriteriaId": "9E698DFA-1684-43E3-9964-0E207A7A2CC1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.5.0-02283:*:*:*:*:*:*:*",
              "matchCriteriaId": "F2F44543-2404-4CDF-9D2F-1B851660F5D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.5.0-02624:*:*:*:*:*:*:*",
              "matchCriteriaId": "1E14F40F-4AA1-42B4-998E-AC965FBBE519",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sonicwall:sma8200v:12.5.0-02800:*:*:*:*:*:*:*",
              "matchCriteriaId": "43197E99-0500-4971-8A66-4E70F8138289",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sonicwall:sma8200v:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "653B5F4D-7417-4A85-B385-46157A1540A6",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location."
    }
  ],
  "id": "CVE-2026-15409",
  "lastModified": "2026-07-16T05:16:18.293",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.0,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-15409",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-14T00:00:00+00:00",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-14T20:16:56.783",
  "references": [
    {
      "source": "PSIRT@sonicwall.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409"
    }
  ],
  "sourceIdentifier": "PSIRT@sonicwall.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "PSIRT@sonicwall.com",
      "type": "Secondary"
    }
  ]
}

GHSA-35RC-2VCV-R6Q5

Vulnerability from github – Published: 2026-07-14 21:32 – Updated: 2026-07-14 21:32

Details

Severity

10.0 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-15409"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-14T20:16:56Z",
    "severity": "CRITICAL"
  },
  "details": "A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.",
  "id": "GHSA-35rc-2vcv-r6q5",
  "modified": "2026-07-14T21:32:16Z",
  "published": "2026-07-14T21:32:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15409"
    },
    {
      "type": "WEB",
      "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

NCSC-2026-0239

Vulnerability from csaf_ncscnl - Published: 2026-07-15 09:56 - Updated: 2026-07-15 09:56

Summary

Zero-Day kwetsbaarheden verholpen in SonicWall SMA1000

Scope

2 vulnerabilities in this advisory, including CVE-2026-15409.

CVE-2026-15409

Two critical vulnerabilities in SonicWall SMA1000 appliances include an SSRF allowing remote unauthenticated attackers to make unintended requests and a post-authentication code injection enabling remote authenticated attackers to execute arbitrary OS commands.

10.0 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Known affected: 1 product

Open the full advisory

WID-SEC-W-2026-2346

Vulnerability from csaf_certbund - Published: 2026-07-14 22:00 - Updated: 2026-07-14 22:00

Summary

SonicWall SMA: Mehrere Schwachstellen

Severity

Kritisch

Scope

2 vulnerabilities in this advisory, including CVE-2026-15409.

CVE-2026-15409

Known affected: 2 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-15409 (GCVE-0-2026-15409)

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Vendor Report Successful Exploitation Confidence: 80% Source: cisa-kev

Details

References

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Successful Exploitation Confidence: 70% Source: previdian

Details

References

BDU:2026-09726 (CVE-2026-15409)

CERTFR-2026-ALE-006

Solutions

CERTFR-2026-AVI-0875

Solutions

EUVD-2026-344017

FKIE_CVE-2026-15409

GHSA-35RC-2VCV-R6Q5

NCSC-2026-0239

WID-SEC-W-2026-2346

Tags

Sightings

Nomenclature

Related by attack behaviour