{"id":"CVE-2026-15409","kind":"vulnerability","aliases":["CVE-2026-15409"],"related":[],"title":"A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface","description":"SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"SonicWall SMA1000 appliances contain a server-side request forgery flaw that lets a remote unauthenticated attacker make the appliance send requests to unintended destinations. CISA lists it as actively exploited, and the ransomware tag suggests it has been used in ransomware campaigns.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2026-07-14T00:00:00+00:00","products":[{"name":"SonicWall SMA1000 Appliances","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"sonicwall sma6210 firmware","fixed":[],"affected":"= 12.4.3-03245","ecosystem":"vendor"},{"name":"sonicwall sma6210 firmware","fixed":[],"affected":"= 12.4.3-03387","ecosystem":"vendor"},{"name":"sonicwall sma6210 firmware","fixed":[],"affected":"= 12.4.3-03434","ecosystem":"vendor"},{"name":"sonicwall sma6210 firmware","fixed":[],"affected":"= 12.5.0-02283","ecosystem":"vendor"},{"name":"sonicwall sma6210 firmware","fixed":[],"affected":"= 12.5.0-02624","ecosystem":"vendor"},{"name":"sonicwall sma6210 firmware","fixed":[],"affected":"= 12.5.0-02800","ecosystem":"vendor"},{"name":"sonicwall sma7210 firmware","fixed":[],"affected":"= 12.4.3-03245","ecosystem":"vendor"},{"name":"sonicwall sma7210 firmware","fixed":[],"affected":"= 12.4.3-03387","ecosystem":"vendor"},{"name":"sonicwall sma7210 firmware","fixed":[],"affected":"= 12.4.3-03434","ecosystem":"vendor"},{"name":"sonicwall sma7210 firmware","fixed":[],"affected":"= 12.5.0-02283","ecosystem":"vendor"},{"name":"sonicwall sma7210 firmware","fixed":[],"affected":"= 12.5.0-02624","ecosystem":"vendor"},{"name":"sonicwall sma7210 firmware","fixed":[],"affected":"= 12.5.0-02800","ecosystem":"vendor"},{"name":"sonicwall sma8200v","fixed":[],"affected":"= 12.4.3-03245","ecosystem":"vendor"},{"name":"sonicwall sma8200v","fixed":[],"affected":"= 12.4.3-03387","ecosystem":"vendor"},{"name":"sonicwall sma8200v","fixed":[],"affected":"= 12.4.3-03434","ecosystem":"vendor"},{"name":"sonicwall sma8200v","fixed":[],"affected":"= 12.5.0-02283","ecosystem":"vendor"},{"name":"sonicwall sma8200v","fixed":[],"affected":"= 12.5.0-02624","ecosystem":"vendor"},{"name":"sonicwall sma8200v","fixed":[],"affected":"= 12.5.0-02800","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["appliance","exploited","ransomware","self-hosted","sma1000","sonicwall","vendor"],"not_affected_if":["managed-hosting"],"how_to_check":null,"fix":"Apply the vendor mitigation or patch from SonicWall per CISA BOD 26-04 guidance; if no mitigation is available, discontinue use of the product as CISA directs. Exact fixed version: unknown","status":"open","published_at":"2026-07-14T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:33:40+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:33:40Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or patch from SonicWall per CISA BOD 26-04 guidance; if no mitigation is available, discontinue use of the product as CISA directs. Exact fixed version: unknown","summary":"SonicWall SMA1000 appliances contain a server-side request forgery flaw that lets a remote unauthenticated attacker make the appliance send requests to unintended destinations. CISA lists it as actively exploited, and the ransomware tag suggests it has been used in ransomware campaigns.","category":"vendor","who_cares":["sonicwall","sma1000","self-hosted","appliance"],"confidence":0.6,"analyst_note":"Find SonicWall's advisory for CVE-2026-15409 to get affected and fixed versions, mitigation steps, and log indicators; check the CISA KEV entry linked in the sources.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"severity_if_unknown":"high"},"cost_usd":0.000397,"input_tokens":2234,"output_tokens":347,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':174C,200C,231C '-15409':21A,24A '-2026':20A,23A '26':173C,199C,230C 'accord':163C 'action':159C 'activ':114B 'adher':227C 'allow':141C 'appli':160C 'applianc':15A,76B,87B,104B,130C,150C 'appliances':27A 'applic':197C 'asset':221C 'attack':101B,145C 'base':178C 'bod':172C,198C,229C 'campaign':127B 'caus':148C 'cisa':110B,157C,170C,187C 'cloud':203C 'complianc':168C 'contain':88B,131C 'could':140C 'cve':19A,22A 'destin':109B 'discontinu':206C 'ensur':167C,226C 'evalu':219C 'exploit':77B,115B 'exposur':224C 'firmware':30A,33A,36A,39A,42A,45A,48A,51A,54A,57A,60A,63A 'flaw':95B 'follow':196C 'forens':189C 'forgeri':6A,94B,137C 'guidanc':185C,201C 'guidelin':233C 'host':81B 'identifi':11A 'instruct':166C 'interfac':18A 'internet':223C 'let':97B 'list':111B 'locat':156C 'make':102B,152C 'mitig':161C,212C 'note':184C,195C 'patch':232C 'place':17A 'potenti':147C 'priorit':175C 'product':210C 'ransomwar':78B,118B,126B 'remot':99B,143C 'request':5A,93B,106B,136C,153C 'requir':158C,191C 'respons':217C 'risk':180C 'secur':176C 'see':181C,192C 'self':80B 'self-host':79B 'send':105B 'server':3A,91B,134C 'server-sid':2A,90B,133C 'servic':204C 'side':4A,92B,135C 'sma1000':14A,26A,82B,86B,129C 'sma6210':29A,32A,35A,38A,41A,44A 'sma7210':47A,50A,53A,56A,59A,62A 'sma8200v':65A,67A,69A,71A,73A,75A 'sonicwal':83B,85B,128C 'sonicwall':25A,28A,31A,34A,37A,40A,43A,46A,49A,52A,55A,58A,61A,64A,66A,68A,70A,72A,74A 'ssrf':7A 'stakehold':215C 'suggest':120B 'tag':119B 'triag':190C 'unauthent':100B,144C 'unavail':214C 'unintend':108B,155C 'updat':177C 'url':182C,193C 'use':124B,207C 'vendor':84B,165C 'vulner':8A,138C 'work':16A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-07-14T00:00:00+00:00","kev":{"dateAdded":"2026-07-14","dueDate":"2026-07-17","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-15409","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-15409","severity":null,"published_at":"2026-07-14T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T15:39:39+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-15409","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15409","severity":null,"published_at":"2026-07-14T20:16:56+00:00","modified_at":"2026-07-16T05:16:18+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}