# SonicWall SMA1000 SSRF (CVE-2026-15409) and Post-Auth Code Injection (CVE-2026-15410) Exploited as Zero-Days

> SonicWall disclosed two SMA1000 vulnerabilities under active zero-day exploitation: an unauthenticated critical SSRF in the Work Place interface (CVE-2026-15409, CVSS 10.0) and a post-authentication OS command injection in the Management Console (CVE-2026-15410, CVSS 7.2), being chained in tandem against SMA6210/7210/8200v appliances.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-10-09T02:23:04.129Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1335
- **ID:** TL-2026-1335
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** INC Ransom
- **Detections:** 9 · **IOCs:** 35 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-15409, CVE-2026-15410

## Description

SonicWall's PSIRT issued advisory SNWLID-2026-0008 for two vulnerabilities in the SMA1000 Secure Mobile Access appliance line (models SMA6210, SMA7210, SMA8200v), confirming multiple cases of active zero-day exploitation observed prior to public disclosure on 2026-07-14.

CVE-2026-15409 is a critical (CVSS 3.1 base score 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) server-side request forgery (CWE-918) in the SMA1000 Work Place interface. An unauthenticated remote attacker sends a specially crafted, URL-encoded request that causes the appliance to make requests to an unintended internal or external location, effectively giving the attacker a foothold to reach internal management surfaces from the unauthenticated Work Place portal.

CVE-2026-15410 is a high-severity (CVSS 3.1 base score 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) post-authentication improper control of code generation (code injection, CWE-94) in the SMA1000 Appliance Management Console (AMC). Under specific conditions, a remote attacker already holding administrator-level authentication to the AMC can inject and execute arbitrary operating system commands, achieving full remote code execution on the appliance.

In observed attacks the two flaws are being exploited in tandem: the SSRF in the unauthenticated Work Place interface is used to reach or manipulate the AMC context, after which the code-injection primitive is used to execute OS commands and take full control of the appliance. Because SMA1000 devices are internet-facing SSL-VPN gateways brokering access into enterprise, government, and MSSP networks, a compromised appliance gives an attacker a durable foothold for lateral movement into the protected internal network.

SonicWall's guidance states that patching alone is not sufficient for appliances that show indicators of compromise: affected organizations should review extraweb_access.log and ctrl-service.log for the documented log signatures, re-image (physical) or redeploy (virtual) any appliance showing IOC hits, and reset all user/administrator credentials and TOTP tokens. No workaround exists short of patching; Shadowserver identified more than 950 internet-exposed SMA1000 appliances at time of disclosure. CISA added both CVEs to the Known Exploited Vulnerabilities catalog and set a federal remediation deadline of 2026-07-17 under BOD 26-04.

## MITRE ATT&CK

- T1595 Active Scanning
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1059.004 Unix Shell
- T1078 Valid Accounts
- T1068 Exploitation for Privilege Escalation
- T1070 Indicator Removal
- T1685.006 Clear Linux or Mac System Logs
- T1211 Exploitation for Stealth
- T1556 Modify Authentication Process
- T1071 Application Layer Protocol
- T1587.004 Exploits
- T1016 System Network Configuration Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1041 Exfiltration Over C2 Channel
- T1059.006 Command and Scripting Interpreter: Python
- T1505.003 Server Software Component: Web Shell
- T1037 Boot or Logon Initialization Scripts
- T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid
- T1055 Process Injection
- T1040 Network Sniffing
- T1090 Proxy

## Sources

- [SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now](https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-sma1000-flaws-exploited-in-zero-day-attacks-patch-now/)
- [SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410)](https://www.helpnetsecurity.com/2026/07/14/sonicwall-sma-attacks-via-cve-2026-15409-cve-2026-15410/)
- [SonicWall SMA1000 Vulnerability Let Attackers to Exploit Encoded URLs To Gain Internal Systems Access Remotely](https://cybersecuritynews.com/sonicwall-sma1000-vulnerability/)
- [Hackers Actively Exploit SonicWall SMA1000 Zero-Day to Escalate Privileges](https://gbhackers.com/hackers-actively-exploit-sonicwall-sma1000-zero-day/)
- [SonicWall Edge Access Devices Hit by Zero-Day Attacks](https://www.darkreading.com/vulnerabilities-threats/sonicwall-edge-devices-zero-day-attacks)
- [NVD - CVE-2026-15409](https://nvd.nist.gov/vuln/detail/CVE-2026-15409)
- [NVD - CVE-2026-15410](https://nvd.nist.gov/vuln/detail/CVE-2026-15410)
- [SonicWall PSIRT Advisory SNWLID-2026-0008](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409)
- [SonicWall SMA 1000 Series vulnerability actively exploited](https://www.scworld.com/brief/sonicwall-sma-100-series-vulnerability-actively-exploited)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1335