CVE-2026-15409: SonicWall SMA 1000 Zero-Day SSRF-to-RCE Exploited

This week in our InSEKurity of the Week series: two zero-day vulnerabilities in SonicWall’s Secure Mobile Access (SMA) 1000 remote-access appliance that are being exploited in the wild right now. The headline flaw, CVE-2026-15409, is an unauthenticated Server-Side Request Forgery (SSRF) in the internet-facing WorkPlace interface — a perfect CVSS 10.0. On its own it lets a remote attacker with no credentials coax the appliance into making requests to internal destinations, including services bound to the box’s own loopback interface that were never meant to be reachable from outside. Chained with CVE-2026-15410, a post-authentication OS command injection in the Appliance Management Console, the attacker turns that internal reach into arbitrary command execution as root on the appliance. SonicWall, Rapid7’s MDR team, and Volexity all observed the same operation: attackers quietly compromise the SMA 1000, then loot credentials, active session databases, and TOTP multi-factor seed configurations to guarantee long-term access — before pivoting into the internal Active Directory. Because the SMA 1000 sits at the network perimeter as the front door for remote employees, a compromise here is a compromise of everyone who logs in through it. If you run an SMA 1000, this is a drop-everything, patch-tonight event.

🚨 Summary

CVE IDs: CVE-2026-15409 (SSRF, the unauthenticated entry point) and CVE-2026-15410 (code injection, the privilege-to-root step)
CVSS 3.1 Score: 10.0 Critical for CVE-2026-15409 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H); 7.2 High for CVE-2026-15410 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
CWE: CWE-918 (Server-Side Request Forgery) for -15409; CWE-94 (Improper Control of Generation of Code / Code Injection) for -15410
Affected Software: SonicWall SMA 1000 series — models 6210, 7210, 8200v and CMS (Central Management Server), across all hypervisors
Attack Vector: Network — the WorkPlace portal is internet-facing by design; SSRF needs no authentication
Authentication Required: None for CVE-2026-15409; administrator session for CVE-2026-15410 (which the chain obtains via the SSRF, not via legitimate login)
User Interaction: None
Impact: Full appliance compromise — root code execution, theft of credentials, session databases, and TOTP MFA seeds, then lateral movement into the internal network
Patch Status: ✅ Available — fixed in 12.4.3-03453 and later, and 12.5.0-02835 and later (released July 14, 2026)
Published: July 14, 2026 (SonicWall advisory and coordinated disclosure)
Exploitation Status: 🔴 Actively exploited as a zero-day — Rapid7 observed exploitation before public disclosure; SonicWall confirmed multiple in-the-wild cases
CISA KEV: ✅ Listed — both CVEs added July 14, 2026; federal remediation deadline July 17, 2026 under BOD 26-04
The SMA 100 series is NOT affected — this advisory is specific to the SMA 1000 line

🖥️ What is SonicWall SMA 1000?

SonicWall Secure Mobile Access (SMA) 1000 is an enterprise remote-access gateway. It is the appliance an organization stands up at its network edge so that employees, contractors, and partners can reach internal applications from anywhere — a clientless web portal (“WorkPlace”), a full VPN tunnel, and per-application access controls, with multi-factor authentication in front. The 1000 series (models 6210, 7210, and the 8200v virtual appliance) is the higher-capacity line aimed at mid-to-large enterprises, and a Central Management Server (CMS) coordinates fleets of them. In practice the SMA 1000 is the single, internet-facing chokepoint through which a company’s entire remote workforce authenticates.

That role is exactly what makes it such a high-value target. A remote-access gateway, by definition, is reachable from the whole internet, holds or brokers the credentials of everyone who logs in, and sits with one foot in the untrusted internet and the other inside the corporate LAN. Edge appliances of this class — from SonicWall, Ivanti, Fortinet, Citrix, and others — have been the pre-eminent initial-access target for ransomware crews and state actors for years, precisely because owning the gateway means owning the front door. When the gateway itself can be taken over without credentials, every user behind it is exposed.

Typical Use Cases

Employee remote access: clientless (browser) and tunnel VPN access to internal web apps, file shares, and RDP/SSH for a distributed workforce.
Third-party and contractor access: granular, per-application access for partners without handing out full network connectivity.
BYOD and unmanaged devices: the WorkPlace portal delivers access from devices the organization does not control.
MFA-gated entry: TOTP and other second factors enforced at the gateway before any internal resource is reached.
Centralized fleets: multiple appliances managed together through the CMS in large or multi-site deployments.

🔍 Technical Analysis

Vulnerability Description

The attack is a two-stage chain. The first stage, CVE-2026-15409, is a Server-Side Request Forgery in the SMA 1000 WorkPlace interface — the same portal legitimate users hit. A websocket-proxy feature accepts attacker-controlled host and port parameters and dutifully opens a TCP connection to whatever is specified, functioning as a netcat-like tunnel from the appliance itself. Because the request is served before authentication for the affected code path, a remote attacker with no account can point that tunnel at the appliance’s own loopback interface (127.0.0.1 / 0.0.0.0) and reach internal management services that were never intended to be exposed to the network — services that trust anything coming from localhost.

The second stage, CVE-2026-15410, is an OS command injection in the Appliance Management Console (AMC). A hotfix-rollback workflow builds a shell command from an attacker-influenced path parameter without proper sanitization; a path-traversal value lets the attacker point that workflow at a script they staged, which the appliance then makes executable and runs as root. Reached through the SSRF’s localhost tunnel, this converts “make the box talk to itself” into “run my code as root on the box.” Neither bug requires a legitimate credential from the attacker’s side — the SSRF supplies the trusted internal vantage point the code-injection step assumes.

Root Cause Analysis

Unauthenticated, attacker-controlled request target (CWE-918): the WorkPlace websocket-proxy endpoint takes host and port from the request and connects to them with no allow-list and no authentication gate on the affected path. The appliance becomes a request-forwarding proxy for the attacker.
Implicit trust of loopback services: internal management components bound to 127.0.0.1 assume that anything connecting from localhost is trusted. The SSRF breaks that assumption by originating the connection from the appliance itself on the attacker’s behalf.
Unsanitized path in a shell workflow (CWE-94): the AMC hotfix-rollback logic constructs a command from a hotfix path parameter and does not neutralize ../ traversal, so an attacker can escape the intended directory and designate an arbitrary file.
Excessive privilege: that file is made executable and run as root, so a single injected path yields full-privilege code execution rather than a limited-user shell.
Chainability: the SSRF’s localhost reach satisfies the “authenticated/internal” precondition the code-injection step relies on, so two individually-scoped bugs combine into an unauthenticated-to-root path.

Attack Vector

The flow below is illustrative — it describes the shape of the published attack chain for defenders (per Rapid7’s and SonicWall’s write-ups) and is deliberately not a working exploit. Do not treat it as copy-paste PoC.

# Illustrative attack chain -- NOT a functional exploit. For defenders only.

Internet attacker (no credentials)
      |
      | (1) CVE-2026-15409 SSRF: request the WorkPlace websocket proxy and
      |     set host/port to the appliance's OWN loopback, tunneling to an
      |     internal management service that trusts localhost.
      v
SMA 1000 WorkPlace portal (internet-facing, :443)
      |
      |     appliance opens a TCP tunnel to 127.0.0.1:<internal-svc>
      v
Internal management service bound to localhost (never meant to be exposed)
      |
      | (2) CVE-2026-15410 code injection: drive the AMC hotfix-rollback
      |     workflow with a path-traversal value pointing at an attacker
      |     -staged script.
      v
Root command execution on the appliance
      |
      | (3) Post-exploitation: dump credentials, active session DB, and
      |     TOTP MFA seed configs; establish persistence.
      v
Pivot into the internal network / Active Directory

The public technical write-ups describe the SSRF being aimed at loopback-bound internal services (an Erlang control process and the appliance’s control service), and the code-injection step abusing the hotfix-rollback path handling to execute a staged script as root. The exact request payloads are documented publicly by Rapid7 for detection purposes; we intentionally do not reproduce a runnable exploit here.

Exploitation in the Wild

Zero-day exploitation preceded disclosure. Rapid7’s MDR team detected the activity before SonicWall’s July 14 advisory, observing attackers compromise appliances for stealthy initial access.
Both bugs are used in tandem — the SSRF for the unauthenticated foothold, the code injection for root — indicating an operator who understood the full chain rather than opportunistic scanning.
The objective is durable access. Once on the appliance, attackers extracted credentials, active session databases, and TOTP MFA seed configurations — everything needed to impersonate legitimate users and survive a simple password reset.
Lateral movement followed. Observed post-compromise activity included pivoting toward internal Active Directory using harvested credentials, with logons from atypical, non-corporate workstation names (e.g. hostnames like kali).
CISA agrees it is urgent. Both CVEs were added to the KEV catalog on the day of disclosure with a three-day federal remediation deadline (July 17, 2026).

Post-Exploitation Impact

Root on the perimeter gateway: full control of the appliance that fronts all remote access.
Mass credential theft: usernames and passwords of everyone who authenticates through the gateway.
Session hijacking: stolen active-session databases let attackers ride existing authenticated sessions without logging in.
MFA bypass at scale: exfiltrated TOTP seed configurations let attackers generate valid second-factor codes for affected accounts.
Internal lateral movement: harvested credentials feed pivots into Active Directory and internal applications behind the gateway.
Stealthy, resilient persistence: config tampering and looted secrets mean a mere patch does not evict an attacker who already got in — SonicWall explicitly states patching alone is insufficient.

⚠️ Impact Assessment

Immediate Impact

Unauthenticated internet-to-root on the appliance: the SSRF needs no credentials, and the chain ends at root.
Everyone behind the gateway is exposed: credentials, sessions, and MFA seeds for the entire remote workforce are in scope.
Active exploitation, not theoretical: this was a live zero-day before it was a CVE.
Patching is necessary but not sufficient: if you were exposed, assume the secrets on the box are compromised.
Federal urgency: a three-day KEV deadline underscores how fast this needs to move.

Affected Versions

Component	Vulnerable versions	Fixed version
SMA 1000 (6210, 7210, 8200v) & CMS, 12.4.3 branch	12.4.3-03245, 12.4.3-03387, 12.4.3-03434	12.4.3-03453 and higher
SMA 1000 (6210, 7210, 8200v) & CMS, 12.5.0 branch	12.5.0-02283, 12.5.0-02624, 12.5.0-02800	12.5.0-02835 and higher

The SMA 100 series is not affected by these CVEs. Only the SMA 1000 line (and its CMS) is in scope. Always cross-reference the official SonicWall advisory for the exact fixed build for your model.

Affected Environments

Internet-exposed SMA 1000 gateways: any appliance with the WorkPlace portal reachable from the internet — i.e. essentially all of them, since that is the product’s purpose.
Enterprises with large remote workforces: the more users authenticate through the gateway, the larger the credential/session/MFA haul from a compromise.
Organizations relying on TOTP MFA at the gateway: seed theft undermines that control specifically.
Fleets managed via CMS: central management is also listed as affected, widening the blast radius.

Attacker Profiles

Ransomware and initial-access brokers: perimeter appliances are their favored entry point; root on the gateway is premium initial access.
State-sponsored / espionage actors: long-running access to a remote-access gateway yields continuous credential and session visibility.
Opportunistic operators: with an unauthenticated CVSS 10.0 and public detail, wide internet scanning for exposed SMA 1000s is expected.

🛡️ Mitigation Strategies

Immediate Actions (Priority 1) ⚡

Upgrade to a fixed build immediately. Download from mysonicwall.com and install the fixed version for your branch. In the Appliance Management Console, the current firmware and hotfix version is shown at the bottom-left of every AMC page and on the login Dashboard under System Information — confirm it reads 12.4.3-03453+ or 12.5.0-02835+ after upgrading:
- 12.4.3 branch → 12.4.3-03453 or higher
- 12.5.0 branch → 12.5.0-02835 or higher
There is no workaround — patching (plus the compromise assessment below) is the only remediation SonicWall offers.

Assume compromise if you were exposed, and hunt before you trust the box. SonicWall is explicit that patching alone is not enough. Review the appliance logs for the indicators below. On the SMA 1000, the Web-proxy access log lives under /var/log/aventail/ (extraweb_access.log, with rotated copies extraweb_access.log1...log7), per the SonicWall administration guide:

# Review the WorkPlace/Web-proxy access log for SSRF exploitation:
# look for websocket-proxy (wsproxy) requests that returned HTTP 101
# (protocol switch) with a loopback/localhost target host parameter.
grep -E -i 'wsproxy' /var/log/aventail/extraweb_access.log | grep -E ' 101 '
grep -E -i 'wsproxy.*(localhost|127\.0\.0\.1|0\.0\.0\.0|::1)' /var/log/aventail/extraweb_access.log*

Reset every secret the appliance ever held. Because credentials, session databases, and TOTP seeds may have been exfiltrated, rotate them regardless of whether you find IoCs:
- Force a password reset for all users and administrators.
- Re-provision all TOTP/MFA tokens (the old seeds must be considered burned).
- Invalidate all active sessions so stolen session data is useless.
Rebuild if you find evidence of compromise. Per SonicWall’s guidance, do not try to clean a compromised appliance in place — re-image physical units or redeploy virtual ones from a known-good image, then apply the fixed firmware before returning to service.

Detection Measures 🔍

Search appliance logs and your SIEM for the indicators security researchers documented:

# 1) Code-injection / privilege-escalation attempts: the control-service
#    log shows the hotfix-rollback workflow invoked with a path-traversal
#    value pointing at an attacker-staged script (e.g. under /tmp).
grep -E -i 'remove_hotfix|rollback' /var/log/aventail/ctrl-service.log | grep -E '\.\./|/tmp/'

# 2) Web-server config tampering: legitimate SMA 1000 configs do NOT
#    contain routes for /__api__/login or /__api__/logout. Their presence
#    in the Unit config is a strong compromise indicator.
grep -E -i '__api__/(login|logout)' /var/lib/unit/conf.json

# 3) Portal enumeration: repeated hits to the login page and to the
#    session-token authentication API can precede exploitation.
grep -E -i '/auth1\.html|/__api__/logon/.*/authenticate' /var/log/aventail/extraweb_access.log*

Additional hunting:

Correlate appliance activity with internal Active Directory logons (Event ID 4624, logon type 3) originating from the appliance’s internal IP, especially with non-corporate workstation names such as kali, localhost, or random DESKTOP-XXXXXXX strings.
Watch for outbound connections from the appliance to unfamiliar external IP ranges; Rapid7 published attacker infrastructure ASNs and CIDRs — ingest those into your blocklists and threat-hunt.
Alert on access to sensitive on-box paths (e.g. /tmp/temp.db*) and unexpected new files under /tmp.
Ship SMA 1000 logs to your SIEM continuously — an appliance you can only inspect after a compromise is an appliance you cannot trust.

Long-term Security Improvements

Treat edge appliances as crown jewels: put remote-access gateways on the fastest possible emergency-patch SLA — their compromise is a whole-org event, not a single-host one.
Restrict management-plane exposure: never expose the Appliance Management Console to the internet; limit it to a dedicated, tightly controlled admin network.
Segment the gateway from the crown-jewel network: assume the gateway will eventually be breached and limit what a compromised gateway can reach internally.
Phishing-resistant MFA: TOTP seeds are exfiltratable; migrate high-value access toward hardware-backed, phishing-resistant factors (FIDO2/WebAuthn) where possible.
Continuous log shipping and monitoring: get appliance logs off the box in real time so detection does not depend on an intact, trustworthy appliance.
Rehearse appliance compromise: include “the VPN gateway is owned” in incident-response tabletop exercises, including credential/session/MFA rotation at scale.

🎯 Why is this Critical?

Unauthenticated CVSS 10.0: the entry point needs no credentials and scores a perfect 10.
Ends at root: the chain runs arbitrary code as root on the appliance.
Live zero-day: exploited in the wild before the fix existed, not a lab curiosity.
The gateway is the keys to the kingdom: it holds credentials, sessions, and MFA seeds for the whole remote workforce.
Patching is not enough: exfiltrated secrets survive the update, so cleanup requires rotation and, if compromised, rebuild.
Edge appliances are the #1 initial-access target: this is exactly the class of bug ransomware and state actors race to weaponize.
Federal three-day deadline: the KEV timeline reflects real, urgent risk.

🚀 Timeline and Disclosure

Prior to 2026-07-14 — Rapid7’s MDR team observes active zero-day exploitation of the SMA 1000 chain in customer environments.
2026-07-14 — SonicWall publishes its advisory and releases fixed firmware (12.4.3-03453, 12.5.0-02835); CVE-2026-15409 and CVE-2026-15410 are disclosed. CISA adds both to the KEV catalog the same day, with a federal remediation deadline of 2026-07-17 under BOD 26-04.
2026-07-15 — SonicWall’s advisory is updated with additional researcher credits; Volexity (Sean Koessel, Steven Adair) helps expand the indicator-of-compromise list.
2026-07-16 — Rapid7 publishes its independent technical analysis and detection guidance.
CW29 (July 13-19, 2026) — coverage across Rapid7, Tenable, Sophos, Help Net Security, BleepingComputer, and The Hacker News amplifies the active-exploitation warning.

🔗 Resources and References

CVE: CVE-2026-15409 (SSRF) and CVE-2026-15410 (code injection)
NVD: NVD — CVE-2026-15409 · NVD — CVE-2026-15410
Vendor advisory: SonicWall Product Notice: SMA 1000 Series affected by Multiple Vulnerabilities
CWE: CWE-918: Server-Side Request Forgery · CWE-94: Improper Control of Generation of Code
CISA KEV Catalog: Known Exploited Vulnerabilities (both CVEs added 2026-07-14)

💼 SEKurity Supports You

The SMA 1000 zero-days are a textbook reminder that your remote-access gateway is simultaneously your most exposed and most trusted asset — reachable by the entire internet, yet holding the credentials, sessions, and MFA seeds of everyone who logs in. An unauthenticated request that ends in root on that box does not just compromise an appliance; it compromises the identity of your whole remote workforce, which is exactly why patching alone cannot close the incident. We help organizations get ahead of precisely this failure mode: inventorying and hardening internet-facing edge appliances, validating that management planes are not exposed where they should not be, and pressure-testing whether a gateway compromise would actually be detected — and how far an attacker could pivot — before it becomes a breach. Our perimeter and large-scale penetration testing targets the VPNs, portals, and gateways your business quietly bets everything on.

Our Services

Penetration Testing: Web applications, mobile apps (Android & iOS), SAP systems, Active Directory
Large-Scale Attacks: Perimeter testing, IT infrastructure testing, Red Team engagements
Security Awareness: Phishing campaigns, hacking demonstrations

Act now — before attackers do.

Contact:

🌐 Website: www.sekurity.de

📧 Inquiries: www.sekurity.de/kontakt

📱 LinkedIn: SEKurity GmbH

Your SEKurity Team — Your Trusted Adversaries

The security of your remote-access infrastructure is our drive.

InSEKurity of the Week (CW29/2026): SonicWall SMA 1000 Unauthenticated SSRF to Root RCE (CVE-2026-15409 & CVE-2026-15410)