SonicWall SMA1000 post-authentication OS command injection
A post-authentication OS command injection in the SonicWall SMA1000 lets an administrator execute arbitrary OS commands on the appliance. Actively exploited alongside CVE-2026-15409; on CISA KEV.
- Vendor
- SonicWall
- Product
- SMA1000 Series (6210, 7210, 8200v)
- CVSS
- 7.2
- EPSS (exploit probability)
- 11.8%
- Status
- kevransomware use
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-15410 being exploited?
Yes. CISA added CVE-2026-15410 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. CISA marks it as known to be used in ransomware campaigns.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 11.8% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-21. Full cross-catalog view: /kev-comparison
CVE-2026-15410 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2026-15410 is a post-authentication OS command injection in the SonicWall SMA1000. Per NVD, the flaw “in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.” SonicWall’s PSIRT confirmed active exploitation prior to the July 14 patch and CISA added it to KEV the same day, with a federal remediation deadline of July 17, 2026.
On its own, CVE-2026-15410 is not remote — it needs admin. In the exploitation SonicWall is describing, it appears alongside CVE-2026-15409, the unauthenticated SSRF in the same appliance, which gives attackers a foothold from which to reach the admin surface. Treat the pair as one chain.
Affected and fixed builds
Vulnerable platform-hotfix builds: 12.4.3-03245, 12.4.3-03387, 12.4.3-03434, 12.5.0-02283, 12.5.0-02624, and 12.5.0-02800. Fixed in 12.4.3-03453 (12.4 branch) and 12.5.0-02835 (12.5 branch), or later. Affected hardware: SMA1000 6210, 7210, and 8200v. The SMA100 series is a separate product line and is not in scope for this advisory.
What to do
Patch to the fixed build before the July 17 CISA deadline. After patching, rotate every admin credential that touched the appliance since the last known-good state — a rotated password on an unpatched box is worthless, but an unrotated password on a patched box is still the second half of this chain. Review extraweb_access.log, ctrl-service.log, and /var/lib/unit/conf.json for the IoCs listed in SNWLID-2026-0008; if any match, rebuild the appliance rather than trusting the patch. Full context in the article writeup.
Other SonicWall CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-102255 Critical remote vulnerability in SonicWall SMA1000write-up | [ CRITICAL ] | 10.0 | 0.5% | — |
| CVE-2026-83549 OS Command Injection in SonicWall SMA1000 AMCwrite-up | [ HIGH ] | 7.8 | 9.9% | |
| CVE-2026-83548 Pre-auth SSRF in SonicWall SMA1000 Workplace Interfacewrite-up | [ HIGH ] | — | 8.0% | |
| CVE-2026-15409 SonicWall SMA1000 unauthenticated SSRF in Work Place portalransomware usewrite-up | [ CRITICAL ] | 10.0 | 6.8% | |
| CVE-2025-40602 SonicWall SMA1000 Missing Authorization Vulnerability | [ MEDIUM ] | 6.6 | 2.8% | |
| CVE-2023-44221 SonicWall SMA100 Appliances OS Command Injection Vulnerability | [ HIGH ] | 7.2 | 76.3% | |
| CVE-2021-20035 SonicWall SMA100 Appliances OS Command Injection Vulnerability | [ MEDIUM ] | 6.5 | 4.2% | |
| CVE-2024-53704 SonicWall SonicOS SSLVPN Improper Authentication Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 95.3% |
