10

CVE-2026-15409: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

CVSS: 10.0v3.1CriticalKEVRansomwareAnalyzed
Published 14-07-2026Last modified 04-08-2026
Open JSON

Vulnerability summary

CVE-2026-15409 is a critical (CVSS 10.0) Server-Side Request Forgery (SSRF) vulnerability in SonicWall SMA1000 Appliances. It is known to be exploited: CISA lists it, first on 14-07-2026. It has been used in ransomware campaigns. EPSS estimates a 6.79% chance of exploitation in the next 30 days, higher than 93.9% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
90/100
0100
Critical · default modelHow is this calculated?
CVSS score
10.0/10
010
Critical · v3.1 (CVE.org)
EPSS score
6.79%
0%100%
Low · -77.74 pp in 30 days
KEVListedCISA
RansomwareKnown useFlagged by CISA
Public exploits1metasploit

Timeline

  1. 14-07-2026
    PublishedVulnerability first disclosed.
  2. 14-07-2026
    Added to CISA KEVSonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
  3. 17-07-2026
    CISA remediation dueApply mitigations per vendor instructions.
  4. 04-08-2026
    Last modifiedVulnerability information updated.

Description

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

6.79%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

-77.74 pp

From 84.54% on 18-09-2026

18-09-202618-10-2026
EPSS score
6.79%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
14-07-2026
Federal due date
17-07-2026
Ransomware

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008 nvd.nist.gov/vuln/detail/CVE-2026-15409

Public exploits

1 found
  • MetasploitMetasploitremoteVerified

    SonicWall SMA1000 WorkPlace wsproxy SSRF Remote Command Execution

    exploit/linux/http/sonicwall_sma1000_wsproxy_rce

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Sonicwall4 products
  • sma1000_firmware≥ 12.4.3-03245, ≤ 12.4.3-03434 | ≥ 12.5.0-02283, ≤ 12.5.0-02800
  • sma6210_firmware12.4.3-03245 | 12.4.3-03387 | 12.4.3-03434 | 12.5.0-02283 | 12.5.0-02624 | 12.5.0-02800
  • sma7210_firmware12.4.3-03245 | 12.4.3-03387 | 12.4.3-03434 | 12.5.0-02283 | 12.5.0-02624 | 12.5.0-02800
  • sma8200v12.4.3-03245 | 12.4.3-03387 | 12.4.3-03434 | 12.5.0-02283 | 12.5.0-02624 | 12.5.0-02800

1 vendor · 4 products

References

2 links