SonicWall SMA1000 unauthenticated SSRF in Work Place portal
An unauthenticated server-side request forgery in the SonicWall SMA1000 Work Place web interface lets a remote attacker force the appliance to make requests to attacker-chosen destinations. Actively exploited; on CISA KEV.
- Vendor
- SonicWall
- Product
- SMA1000 Series (6210, 7210, 8200v)
- CVSS
- 10.0
- EPSS (exploit probability)
- 6.8%
- Status
- kevransomware use
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-15409 being exploited?
Yes. CISA added CVE-2026-15409 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. CISA marks it as known to be used in ransomware campaigns.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 6.8% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-21. Full cross-catalog view: /kev-comparison
CVE-2026-15409 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2026-15409 is an unauthenticated server-side request forgery (SSRF) in the Work Place web interface of the SonicWall SMA1000 remote-access appliance. Per NVD, “a remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.” SonicWall’s PSIRT confirmed active exploitation prior to the July 14 patch and CISA added the CVE to its Known Exploited Vulnerabilities catalog the same day, with a federal remediation deadline of July 17, 2026.
Affected and fixed builds
Vulnerable platform-hotfix builds: 12.4.3-03245, 12.4.3-03387, 12.4.3-03434, 12.5.0-02283, 12.5.0-02624, and 12.5.0-02800. Fixed in 12.4.3-03453 (12.4 branch) and 12.5.0-02835 (12.5 branch), or later. Affected hardware: SMA1000 6210, 7210, and 8200v. The SMA100 series is a separate product line and is not in scope for this advisory.
What to do
Install the patched build on every SMA1000 appliance before the July 17 CISA deadline. If patching has to wait, take the Work Place portal off the internet until the update is applied — the SSRF is pre-auth against that interface. Review the indicators of compromise in SNWLID-2026-0008 (entries in extraweb_access.log, ctrl-service.log, and /var/lib/unit/conf.json), and if anything matches, treat the appliance as compromised rather than merely vulnerable. See the article writeup for the pairing with CVE-2026-15410, the post-auth command injection SonicWall discloses in the same advisory.
Other SonicWall CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-102255 Critical remote vulnerability in SonicWall SMA1000write-up | [ CRITICAL ] | 10.0 | 0.5% | — |
| CVE-2026-83549 OS Command Injection in SonicWall SMA1000 AMCwrite-up | [ HIGH ] | 7.8 | 9.9% | |
| CVE-2026-83548 Pre-auth SSRF in SonicWall SMA1000 Workplace Interfacewrite-up | [ HIGH ] | — | 8.0% | |
| CVE-2026-15410 SonicWall SMA1000 post-authentication OS command injectionransomware usewrite-up | [ HIGH ] | 7.2 | 11.8% | |
| CVE-2025-40602 SonicWall SMA1000 Missing Authorization Vulnerability | [ MEDIUM ] | 6.6 | 2.8% | |
| CVE-2023-44221 SonicWall SMA100 Appliances OS Command Injection Vulnerability | [ HIGH ] | 7.2 | 76.3% | |
| CVE-2021-20035 SonicWall SMA100 Appliances OS Command Injection Vulnerability | [ MEDIUM ] | 6.5 | 4.2% | |
| CVE-2024-53704 SonicWall SonicOS SSLVPN Improper Authentication Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 95.3% |
