{"id":"CVE-2026-15409","published":"2026-07-14T20:16:56Z","modified":"2026-10-24T21:10:00Z","title":"SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability","vendor":"SonicWall","product":"SMA1000 Appliances","tier":"core","eol":null,"description":{"text":"A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.","provenance":"source","from":"NVD"},"summary":{"text":"A server-side request forgery flaw exists in the Work Place interface of SonicWall SMA1000 Appliances. An unauthenticated remote attacker over the network could cause the appliance to send requests to unintended destinations, with no user interaction or special configuration required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:11Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.06795,"percentile":0.93991,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2026-07-14","dueDate":"2026-07-17","ransomware":true,"requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-15409","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-07-14","exploitedFirstSeen":"2026-07-14","ransomware":true,"evidence":[{"url":"https://previdian.com/CVE-2026-15409","date":"2026-07-14"},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008","date":"2026-07-14"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-07-14"},{"url":"https://www.rapid7.com/blog/post/etr-rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410/","date":"2026-07-15"},{"url":"https://www.tenable.com/blog/cve-2026-15409-cve-2026-15410-sonicwall-sma-1000-zero-day-vulnerabilities-exploited-in-the","date":"2026-07-15"},{"url":"https://cydome.io/maritime-cybersecurity-bulletin-july-17th-2026/","date":"2026-07-17"},{"url":"https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/","date":"2026-07-17"},{"url":"https://research.checkpoint.com/2026/20th-july-threat-intelligence-report/","date":"2026-07-20"},{"url":"https://www.resecurity.com/es/blog/article/from-wsproxy-to-root-inc-ransomware-and-sonicwall-sma-exploit-chain","date":"2026-08-01"},{"url":"https://www.cyfirma.com/research/tracking-ransomware-jul-2026/","date":"2026-08-06"}],"evidenceTotal":17,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 31, 2026","url":"https://otx.alienvault.com/pulse/6ae4aefab0c2191cecd41862","created":"2026-10-30"},{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"INC and The Gentlemen Ransomware: Exposed AI Infrastructure","url":"https://otx.alienvault.com/pulse/6ae254acfd783d5b63290659","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"INC and The Gentlemen Ransomware: Exposed AI Infrastructure","url":"https://otx.alienvault.com/pulse/6ad8db024c84442cd0085496","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"}],"provenance":"machine"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated remote exploitation of public-facing web interface","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location","start":118,"end":229}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1090","name":"Proxy","tactics":["command-and-control"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: SSRF proxies attacker requests through appliance","mappingType":"primary_impact","evidence":[{"from":"description","quote":"cause the appliance to make requests to unintended location","start":170,"end":229}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-4cf3172d190519e868ee","title":"Blog | Arctic Wolf","publisher":"arcticwolf.com","url":"https://arcticwolf.com/resources/blog/","date":null,"mentions":[{"quote":"CVE-2026-15409, CVE-2026-15410: Security Bulletin: SonicWall SMA 1000 Series Zero-Day Vulnerabilities","start":10420,"end":10521}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-44404","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44404","exploited":true,"exploitedSince":"2026-07-14","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":6,"skipped":0,"earliest":"2026-07-15","earliestUrl":"https://github.com/HORKimhab/CVE-2026-15409","repos":[{"name":"remmons-r7/rapid7-CVE-2026-15409","url":"https://github.com/remmons-r7/rapid7-CVE-2026-15409","stars":28,"created":"2026-07-15"},{"name":"tc4dy/CVE-2026-15409-15410-Framework","url":"https://github.com/tc4dy/CVE-2026-15409-15410-Framework","stars":6,"created":"2026-07-17"},{"name":"0xBlackash/CVE-2026-15409","url":"https://github.com/0xBlackash/CVE-2026-15409","stars":3,"created":"2026-07-15"},{"name":"Ch4120N/CVE-2026-15409","url":"https://github.com/Ch4120N/CVE-2026-15409","stars":3,"created":"2026-08-03"},{"name":"HORKimhab/CVE-2026-15409","url":"https://github.com/HORKimhab/CVE-2026-15409","stars":0,"created":"2026-07-15"}]},"metasploit":[{"name":"SonicWall SMA1000 WorkPlace wsproxy SSRF Remote Command Execution","module":"exploit/linux/http/sonicwall_sma1000_wsproxy_rce","type":"exploit","disclosureDate":"2026-07-14","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/sonicwall_sma1000_wsproxy_rce.rb"}],"nuclei":[{"id":"CVE-2026-15409","name":"SonicWall SMA1000 - Server-Side Request Forgery","severity":"critical","path":"javascript/cves/2026/CVE-2026-15409.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-15409.yaml"}],"first":{"date":"2026-07-14","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/sonicwall_sma1000_wsproxy_rce.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1090"],"provenance":"ai"}],"timeline":[{"date":"2026-07-14","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15409","provenance":"source"},{"date":"2026-07-14","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2026-07-15","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/sonicwall_sma1000_wsproxy_rce.rb","provenance":"source"},{"date":"2026-07-14","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://previdian.com/CVE-2026-15409","provenance":"source"},{"date":"2026-07-14","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-07-14","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44404","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":0},"priority":{"score":87.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 109 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":18.8,"detail":"percentile 0.9399"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"6 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}