EUVD-2026-44404
GHSA-35rc-2vcv-r6q5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach internet-facing Work Place portal
-
DeliverySubmit crafted URL parameter
-
ExploitTrigger server-side request forgery
-
ExecutionAppliance fetches attacker-chosen target
-
PersistReach internal services / metadata
-
ImpactExfiltrate data or pivot inward
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of the SonicWall SMA1000 Work Place interface (AV:N/AC:L/PR:N/UI:N). The only prerequisites are network reachability to the appliance's Work Place portal and the appliance running an affected build (12.4.3-03245 through 12.4.3-03434, or 12.5.0-02283 through 12.5.0-02800). What limits real-world impact is scope: the attacker controls where the appliance sends requests, so exploitation value depends on what internal services or metadata endpoints are reachable from the appliance's network position; appliances not exposed to untrusted networks or with tight egress filtering present a smaller attack surface. |
| Impact | The signals are strongly aligned toward high priority: CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N with S:C/C:H/I:H/A:H yields 10.0, meaning network-reachable, low-complexity, unauthenticated exploitation with scope change. CISA KEV confirms active exploitation and SSVC rates it Exploitation=active, Automatable=yes, Technical Impact=total - an unambiguous 'act now' classification. Public POC (GitHub, CIRCL) further lowers the barrier to entry. The one contrasting signal is EPSS at 1.40% (69th percentile), which is low for a KEV-listed 10.0; this suggests exploitation is currently targeted/limited rather than internet-wide, but does not reduce urgency for exposed appliances. One caveat worth verifying with the vendor: for a classic SSRF the I:H and A:H integrity/availability impacts assigned by the CVSS vector are unusually high - SSRF most naturally yields confidentiality/pivot impact, so the full C:H/I:H/A:H rating likely reflects downstream compromise potential of the total technical impact rather than direct integrity/availability damage from the SSRF primitive itself. |
| Exploit ScenarioDerived | A remote attacker with no credentials sends a crafted request to the internet-facing SMA1000 Work Place portal, supplying a URL that points at an internal service or the cloud metadata endpoint. The appliance dutifully fetches the attacker-specified target and returns or acts on the response, letting the attacker map and reach internal systems that are not exposed to the internet. Public POC code (GitHub HORKimhab/CVE-2026-15409, CIRCL) makes this scenario turnkey, and it is already being exploited in the wild per CISA KEV. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Server-side request forgery in the SonicWall SMA1000 Appliance Work Place interface lets remote, unauthenticated attackers (PR:N) coerce the appliance into issuing attacker-controlled requests to unintended internal or external destinations. It is confirmed actively exploited (CISA KEV), publicly available exploit code exists, and it carries a maximal CVSS 10.0 with a scope change, making internet-facing SMA1000 appliances a high-priority patch. EPSS is modest at 1.40% (69th percentile), which alongside KEV points to targeted rather than mass-scanning exploitation so far.
RemediationAI
Upgrade SMA1000 firmware to a fixed build above the affected ranges (later than 12.4.3-03434 on the 12.4.x branch and later than 12.5.0-02800 on the 12.5.x branch); consult SonicWall PSIRT advisory SNWLID-2026-0008 (https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008) for the exact patched version, as a specific fixed build is not enumerated in the provided data and should be confirmed with the vendor before patching. Because this is confirmed actively exploited (CISA KEV), patching is required on CISA's due-date timeline for federal agencies and is strongly advised for all operators. As a compensating control until patched, restrict reachability of the Work Place interface - place the appliance behind allowlisted source IPs or a WAF, and constrain outbound connectivity from the appliance with egress firewall rules that block requests to internal RFC1918 ranges and cloud metadata endpoints (169.254.169.254), which limits SSRF pivot value at the cost of breaking any legitimate internal integrations the portal relies on. Given active exploitation, also hunt for indicators of prior compromise (anomalous outbound requests from the appliance) before assuming mitigation alone is sufficient.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The SMA1000 is SonicWall's Secure Mobile Access appliance line, providing clientless VPN and remote access; the affected component is the browser-facing Work Place portal. The root cause class is CWE-918 (Server-Side Request Forgery): the Work Place interface accepts a URL or destination parameter and fetches it server-side without adequately validating or restricting the target, so the appliance itself becomes a proxy for requests it should never make. Because the appliance sits at the network edge with privileged reachability into internal segments and cloud metadata endpoints, an SSRF here allows an external actor to reach services that are otherwise unreachable from the internet. The single affected product per CPE is cpe:2.3:a:sonicwall:sma1000, with no other vendors implicated.
Know when Sma1000 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Remote unauthenticated SSRF (AV:N/AC:L/PR:N/UI:N) with scope change (S:C) into internal systems gives high confidentiality; direct integrity is limited and availability impact is not inherent to an SSRF primitive.
Primary rating from Vendor (sonicwall).
CVSS VectorVendor: sonicwall
Lifecycle Timeline
2DescriptionCVE.org
A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.
Articles & Coverage 1
Executive ViewAI
SonicWall SMA1000 remote access appliances are confirmed actively exploited (CISA KEV) via a critical network flaw that enables unauthenticated attackers to redirect internal appliance requests to attacker-controlled destinations. Organizations with internet-facing SMA1000 deployments face immediate risk of internal network reconnaissance, credential harvesting, and lateral movement into protected production environments. No vendor-released patch identified at time of analysis, making this a containment priority rather than a patching issue.
No vendor-released patch identified at time of analysis. Interim mitigations: implement firewall ACLs restricting SMA1000 access to only known, trusted client IP ranges; deploy WAF or IPS signatures targeting SSRF exploitation patterns; disable Work Place interface functionality where operationally feasible; establish enhanced logging and monitoring for anomalous outbound requests from appliances; develop appliance replacement or retirement plans if patch availability remains unclear beyond 60 days.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Pre-authentication server-side request forgery in the SonicWall SMA1000 secure-access appliance's Work Place interface l
OS command injection in the SonicWall SMA1000 Appliance Management Console (AMC) allows a remote authenticated administr
Post-authentication OS command execution in the SonicWall SMA1000 Appliance Management Console (AMC) allows a remote att
Remote code execution in SonicWall SMA1000 (Appliance Management Console) can be triggered by an authenticated administr
Stored cross-site scripting in the SonicWall SMA1000 Appliance Management Console (AMC) allows an attacker who already h
Exploit-DB