# CVE-2026-15409 / CVE-2026-15410: SonicWall SMA 1000 Zero-Day SSRF and Code Injection Chained for Unauthenticated RCE

> SonicWall disclosed and patched two zero-day vulnerabilities in the SMA 1000 Series (models 6210, 7210, 8200v): CVE-2026-15409, a critical (CVSS 10.0) unauthenticated SSRF in the Workplace interface, and CVE-2026-15410, a high-severity (CVSS 7.2) post-authentication code injection in the Appliance Management Console. Threat actors are actively chaining the two flaws to achieve fully remote, unauthenticated arbitrary OS command execution; both CVEs were added to the CISA KEV catalog with a July 17, 2026 federal remediation deadline.

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-07-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1385
- **ID:** TL-2026-1385
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-15409, CVE-2026-15410

## Description

On July 14, 2026, SonicWall published Security Advisory SNWLID-2026-0008 disclosing two zero-day vulnerabilities in the SMA 1000 Series secure remote access appliances (models 6210, 7210, and 8200v, plus Central Management Server across all supported hypervisors) that SonicWall confirmed were being actively exploited in the wild prior to patch availability.

CVE-2026-15409 (CVSS 3.1: 10.0, vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, CWE-918 Server-Side Request Forgery) resides in the SMA1000 Workplace interface and requires no authentication or user interaction. It allows a remote unauthenticated attacker to force the appliance to make network requests to unintended internal or external locations, effectively turning the appliance into an attacker-controlled proxy that can reach otherwise unreachable internal management surfaces. CVE-2026-15410 (CVSS 3.1: 7.2, high, CWE-94 Code Injection) is a post-authentication vulnerability in the Appliance Management Console (AMC) that permits a remote attacker holding administrator-level access to inject and execute arbitrary operating system commands.

SonicWall's investigation, aided by Volexity researchers Sean Koessel and Steven Adair (who identified an additional indicator of compromise), found that observed intrusions chain the two bugs: the unauthenticated SSRF in CVE-2026-15409 is leveraged to reach or interact with the administrative interface, after which the post-authentication code injection in CVE-2026-15410 is triggered to obtain arbitrary OS command execution as administrator. The combined chain therefore yields a fully remote, unauthenticated path to full appliance compromise without any legitimate credentials, despite CVE-2026-15410 nominally requiring authentication in isolation.

Vulnerable platform-hotfix releases span 12.4.3-03245, 12.4.3-03387, and 12.4.3-03434, and 12.5.0-02283, 12.5.0-02624, and 12.5.0-02800. SonicWall shipped fixed hotfixes 12.4.3-03453 and 12.5.0-02835 (and later) with no interim workaround available for unpatched systems — CISA's Binding Operational Directive 26-04 required federal agencies to patch or disconnect affected appliances by July 17, 2026, just three days after public disclosure.

SonicWall published forensic indicators for organizations to hunt for prior compromise: anomalous HTTP 200 requests to `/__api__/login` and `/__api__/logout` in `extraweb_access.log`; suspicious `/wsproxy` requests carrying unusual `host` parameters returning HTTP 101 (WebSocket upgrade) responses, consistent with SSRF-driven proxying; hotfix-removal entries containing path-traversal-style names in `ctrl-service.log`, suggesting attacker tampering with patch/rollback mechanisms to persist access; and unauthorized routes injected into the `/var/lib/unit/conf.json` reverse-proxy configuration file, indicating attacker-added backend routes for persistent access or C2 relay through the compromised appliance. For any organization identifying these indicators, SonicWall's guidance is severe: re-image physical appliances or redeploy virtual instances from a known-clean image (using only backups predating the vulnerable hotfixes), reset all user and administrator credentials, and regenerate TOTP/MFA seeds — reflecting an assumption of full compromise rather than partial remediation.

SMA 1000 appliances are internet-facing secure remote access / SSL-VPN gateways broadly deployed across enterprise, government, financial, and healthcare environments to broker remote employee and third-party access into internal networks, making them a high-value initial-access target: successful exploitation grants a foothold inside the perimeter with a trusted vantage point for internal reconnaissance, credential harvesting, and lateral movement. SonicWall SMA/VPN appliances have a documented history as exploitation targets (e.g., CVE-2019-7481/7483, CVE-2021-20016/20038, CVE-2025-23006, CVE-2025-40602), including prior ransomware-affiliated exploitation of SMA/SSL-VPN devices, underscoring the recurring pattern of edge-appliance zero-days being weaponized rapidly by opportunistic and targeted threat actors alike. No specific threat actor group has been publicly attributed to this campaign as of this writing; SonicWall and Volexity have not disclosed network-layer IOCs (IPs, domains, hashes) publicly, limiting available detection to the host/log-based forensic artifacts above.

## MITRE ATT&CK

- T1595 Active Scanning
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1505 Server Software Component
- T1556 Modify Authentication Process
- T1098 Account Manipulation
- T1068 Exploitation for Privilege Escalation
- T1070 Indicator Removal
- T1211 Exploitation for Stealth
- T1601 Modify System Image
- T1552 Unsecured Credentials
- T1111 Multi-Factor Authentication Interception
- T1046 Network Service Discovery
- T1016 System Network Configuration Discovery
- T1210 Exploitation of Remote Services
- T1090 Proxy
- T1071 Application Layer Protocol
- T1190 Exploit Public-Facing Application

## Sources

- [Tenable: CVE-2026-15409 & CVE-2026-15410 SonicWall SMA 1000 Zero-Day Vulnerabilities Exploited in the Wild](https://www.tenable.com/blog/cve-2026-15409-cve-2026-15410-sonicwall-sma-1000-zero-day-vulnerabilities-exploited-in-the)
- [SonicWall Product Notice: SMA 1000 Series affected by Multiple Vulnerabilities](https://www.sonicwall.com/support/notices/product-notice-sma-1000-series-affected-by-multiple-vulnerabilities/kA1VN000001nv6D0AQ)
- [CISA Known Exploited Vulnerabilities (KEV) Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [BleepingComputer: SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now](https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-sma1000-flaws-exploited-in-zero-day-attacks-patch-now/)
- [The Hacker News: Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands](https://thehackernews.com/2026/07/two-sonicwall-sma-1000-zero-days.html)
- [Help Net Security: SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410)](https://www.helpnetsecurity.com/2026/07/14/sonicwall-sma-attacks-via-cve-2026-15409-cve-2026-15410/)
- [Halo Security: CVE-2026-15409 SonicWall SMA1000 SSRF Vulnerability Advisory](https://cve.halosecurity.com/cve-advisory/cve-2026-15409-sonicwall-sma1000-ssrf-vulnerability-leading-to-unintended)
- [SecurityWeek: SonicWall Issues Urgent SMA Patch Warning for Two Zero-Day Exploits](https://www.securityweek.com/sonicwall-issues-urgent-sma-patch-warning-for-two-zero-day-exploits/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1385