Code Injection in SMA1000 Appliance Management Console (CVE-2026-15410)

A post-authentication code injection vulnerability exists in the SMA1000 Appliance Management Console. Under specific conditions, a remote authenticated attacker with administrator privileges could execute arbitrary OS commands. ⚠️ Actively exploited in the wild (CISA KEV). Affected versions: - 12.4.3-03245 - 12.4.3-03387 - 12.4.3-03434 - 2.5.0-02283 - 12.5.0-02624 - 12.5.0-02800 We recommend updating to: 12.4.3-03453, 12.5.0-02835. CVSS 7.2 · our assessment: act_now Reference: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008 Details: https://vuln.today/cve/CVE-2026-15410