What is the CVSS score of CVE-2026-15409?

CVE-2026-15409 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 1.4%.

Which versions of SonicWall SMA1000 are affected by CVE-2026-15409?

SonicWall SMA1000 remote access appliances are confirmed actively exploited (CISA KEV) via a critical network flaw that enables unauthenticated attackers to redirect internal appliance requests to…

Is there a public PoC exploit available for CVE-2026-15409?

Yes, a public proof-of-concept exploit is available for CVE-2026-15409. Prioritise patching immediately. EPSS: 1.4%.

How to fix or mitigate CVE-2026-15409?

Within 24 hours, conduct inventory of all production SonicWall SMA1000 appliances, identify those exposed to untrusted networks, and implement emergency firewall rules restricting access to only pre-approved client IP ranges where operationally feasible. Within 7 days, deploy network segmentation isolating SMA1000 traffic, configure Web Application Firewall or intrusion prevention rules blocking SSRF attack patterns (requests targeting internal IP ranges, loopback addresses, cloud metadata endpoints), and disable the Work Place interface on appliances where not actively required. Within 30 days, establish formal patch monitoring with SonicWall, evaluate alternative remote access solutions or appliance replacement options, and finalize contingency plans for infrastructure changes if vendor patch timeline extends beyond 90 days.

SonicWall SMA1000 CVE-2026-15409

EUVD-2026-44404 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-14 sonicwall

GHSA-35rc-2vcv-r6q5

SSRF Sma1000

10.0

CVSS 3.1 · Vendor: sonicwall

Severity by source

Vendor (sonicwall) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

ENISA EUVD

CRITICAL

qualitative

vuln.today AI

9.3 CRITICAL

Remote unauthenticated SSRF (AV:N/AC:L/PR:N/UI:N) with scope change (S:C) into internal systems gives high confidentiality; direct integrity is limited and availability impact is not inherent to an SSRF primitive.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (sonicwall).

CVSS VectorVendor: sonicwall

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 14:43 vuln.today

Added to CISA KEV

Jul 14, 2026 - 23:20 CISA

CVE Published

Jul 14, 2026 - 19:39 cve.org

CRITICAL 10.0

DescriptionCVE.org

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.

Articles & Coverage 1

POC CVE-2026-15409: Public Proof-of-Concept Released for Dectect Vulnerability Jul 15, 2026

AnalysisAI

Server-side request forgery in the SonicWall SMA1000 Appliance Work Place interface lets remote, unauthenticated attackers (PR:N) coerce the appliance into issuing attacker-controlled requests to unintended internal or external destinations. It is confirmed actively exploited (CISA KEV), publicly available exploit code exists, and it carries a maximal CVSS 10.0 with a scope change, making internet-facing SMA1000 appliances a high-priority patch. EPSS is modest at 1.40% (69th percentile), which alongside KEV points to targeted rather than mass-scanning exploitation so far.

Technical ContextAI

The SMA1000 is SonicWall's Secure Mobile Access appliance line, providing clientless VPN and remote access; the affected component is the browser-facing Work Place portal. The root cause class is CWE-918 (Server-Side Request Forgery): the Work Place interface accepts a URL or destination parameter and fetches it server-side without adequately validating or restricting the target, so the appliance itself becomes a proxy for requests it should never make. Because the appliance sits at the network edge with privileged reachability into internal segments and cloud metadata endpoints, an SSRF here allows an external actor to reach services that are otherwise unreachable from the internet. The single affected product per CPE is cpe:2.3:a:sonicwall:sma1000, with no other vendors implicated.

RemediationAI

Upgrade SMA1000 firmware to a fixed build above the affected ranges (later than 12.4.3-03434 on the 12.4.x branch and later than 12.5.0-02800 on the 12.5.x branch); consult SonicWall PSIRT advisory SNWLID-2026-0008 (https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008) for the exact patched version, as a specific fixed build is not enumerated in the provided data and should be confirmed with the vendor before patching. Because this is confirmed actively exploited (CISA KEV), patching is required on CISA's due-date timeline for federal agencies and is strongly advised for all operators. As a compensating control until patched, restrict reachability of the Work Place interface - place the appliance behind allowlisted source IPs or a WAF, and constrain outbound connectivity from the appliance with egress firewall rules that block requests to internal RFC1918 ranges and cloud metadata endpoints (169.254.169.254), which limits SSRF pivot value at the cost of breaking any legitimate internal integrations the portal relies on. Given active exploitation, also hunt for indicators of prior compromise (anomalous outbound requests from the appliance) before assuming mitigation alone is sufficient.