Server-Side Request Forgery in SonicWall SMA1000 Appliance Work Place (CVE-2026-15409)

CVE-2026-15409 is a Server-Side Request Forgery (SSRF) vulnerability in the SonicWall SMA1000 Appliance Work Place interface (CWE-918). A remote unauthenticated attacker could exploit this vulnerability to cause the appliance to make requests to unintended locations. The vulnerability carries a CVSS v3 score of 10.0 and is reported as actively exploited in the wild. ⚠️ Actively exploited in the wild (CISA KEV). Affected versions: - 12.4.3-03245 - 12.4.3-03387 - 12.4.3-03434 (platform-hotfix) - 12.5.0-02624 - 12.5.0-02800 (platform-hotfix) We recommend updating to: 12.4.3-03453 (platform-hotfix) and higher versions, 12.5.0-02835 (platform-hotfix) and higher versions. CVSS 10.0 · our assessment: emergency Vendor advisory: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008 Details: https://vuln.today/cve/CVE-2026-15409