# SonicWall SMA1000 SSRF (CVE-2026-15409) and Code Injection (CVE-2026-15410) Actively Exploited in Tandem

> SonicWall SMA1000 secure remote access appliances are under active exploitation via two chained flaws: CVE-2026-15409, a critical unauthenticated SSRF in the Work Place interface, and CVE-2026-15410, a high-severity authenticated code injection in the Management Console. SonicWall has confirmed in-the-wild exploitation and shipped hotfixes for both firmware branches.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1323
- **ID:** TL-2026-1323
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-15409, CVE-2026-15410

## Description

On July 14, 2026, SonicWall's PSIRT disclosed and hotfixed two vulnerabilities in the SMA1000 secure mobile access appliance line (SMA6210, SMA7210, SMA8200v) that are being actively exploited together against internet-facing deployments. CVE-2026-15409 is a critical, unauthenticated Server-Side Request Forgery in the appliance's Work Place (end-user) interface: by supplying a crafted/encoded URL, a remote attacker with no credentials can force the appliance to issue requests to attacker-chosen internal or external destinations, enabling internal network reconnaissance, access to cloud metadata/instance services, or interaction with internal-only management endpoints that are otherwise unreachable from the internet. CVE-2026-15410 is a high-severity code injection flaw in the SMA1000 Appliance Management Console (AMC) that requires authenticated administrator access but allows an attacker who has reached that context to inject and execute arbitrary code/OS commands on the underlying appliance operating system. SonicWall's advisory and public reporting (Help Net Security) describe the two bugs as 'being exploited in tandem' — consistent with SonicWall's SMA1000 exploitation history, where an unauthenticated primitive (SSRF/deserialization) is used to reach or forge access to an authenticated management surface, and a post-auth code-execution bug is then used to obtain full root-level command execution and persistence on the appliance. Vulnerable firmware spans the 12.4.3.x branch (12.4.3-03245, 12.4.3-03387, 12.4.3-03434) and the 12.5.0.x branch (12.5.0-02283, 12.5.0-02624, 12.5.0-02800); SonicWall shipped hotfixes 12.4.3-03453 and 12.5.0-02835. The flaw was reported to SonicWall PSIRT by Adam Babis, and SonicWall issued an advance customer notification ahead of the public advisory. SonicWall recommends organizations that cannot confirm they were unaffected rotate all user and administrator passwords, reset TOTP/MFA tokens bound to the appliance, review authentication and management-console logs for indicators of compromise, and re-image/re-deploy any appliance where compromise is suspected or confirmed. This event continues a well-established pattern for SonicWall SMA1000/SMA100 remote-access appliances, which have been repeatedly targeted by both opportunistic and ransomware-affiliated actors: a critical pre-auth deserialization RCE (CVE-2025-23006, CVSS 9.8) was actively exploited as a zero-day and patched in January 2025; an SSRF in the same Work Place interface (CVE-2025-40595, CVSS 7.2, CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) was patched in the same firmware family in mid-2025; and a local privilege-escalation flaw in the AMC (CVE-2025-40602) was observed chained with CVE-2025-23006 to achieve unauthenticated root-level RCE, later added to CISA's Known Exploited Vulnerabilities catalog in December 2025. Internet-facing exposure of SMA1000 appliances has been tracked by Shadowserver at roughly 950+ hosts at various points during this exploitation history, and ransomware groups (e.g., DarkSide) have historically favored SonicWall SMA100/SMA1000 appliances as an initial-access vector. No CVSS score, formal CWE mapping, or public IOC set (attacker IPs, malware, C2) has been published by SonicWall or third parties for CVE-2026-15409/CVE-2026-15410 as of this writing; defenders should treat any unexplained AMC configuration change, new local/administrator account, or anomalous outbound request originating from the Work Place interface on unpatched SMA1000 appliances as a potential indicator of exploitation.

## MITRE ATT&CK

- T1595 Active Scanning
- T1590 Gather Victim Network Information
- T1588.005 Exploits
- T1588.006 Vulnerabilities
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1059.004 Unix Shell
- T1203 Exploitation for Client Execution
- T1078 Valid Accounts
- T1098 Account Manipulation
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1685 Disable or Modify Tools
- T1552 Unsecured Credentials
- T1556 Modify Authentication Process
- T1046 Network Service Discovery
- T1210 Exploitation of Remote Services
- T1021 Remote Services
- T1005 Data from Local System
- T1090 Proxy
- T1071.001 Web Protocols
- T1041 Exfiltration Over C2 Channel
- T1490 Inhibit System Recovery

## Sources

- [SonicWall SMA attacks via CVE-2026-15409, CVE-2026-15410](https://www.helpnetsecurity.com/2026/07/14/sonicwall-sma-attacks-via-cve-2026-15409-cve-2026-15410/)
- [SonicWall PSIRT Security Advisories](https://psirt.global.sonicwall.com/)
- [Sonicwall warns of new SMA1000 zero-day exploited in attacks](https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-sma1000-zero-day-exploited-in-attacks/)
- [SonicWall warns hackers targeting critical vulnerability in SMA 1000 series appliances](https://www.cybersecuritydive.com/news/sonicwall-hackers-vulnerability-sma-1000/738333/)
- [SonicWall SMA1000 Vulnerability Let Attackers to Exploit Encoded URLs To Gain Internal Systems Access Remotely](https://cybersecuritynews.com/sonicwall-sma1000-vulnerability/)
- [SMA 1000 Series affected by Encoded URL SSRF Vulnerability (SNWLID-2025-0010)](https://www.sonicwall.com/support/notices/product-notice-sma-1000-series-affected-by-encoded-url-ssrf-vulnerability/250513120756710)
- [Multiple Vulnerabilities in SonicWall SMA1000 Series](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-033/)
- [U.S. CISA adds Cisco, SonicWall, and ASUS flaws to its Known Exploited Vulnerabilities catalog](https://securityaffairs.com/185830/security/u-s-cisa-adds-cisco-sonicwall-and-asus-flaws-to-its-known-exploited-vulnerabilities-catalog.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1323