CVE-2026-15409: SonicWall SMA1000 SSRF (KEV, CVSS 10.0)

CVE-2026-15409 is a server-side request forgery in the Work Place web interface of SonicWall SMA1000 Series appliances (models 6210, 7210, 8200v) that lets a remote, unauthenticated attacker make the appliance issue requests to an unintended internal location, and CISA's KEV catalog records this flaw as having known ransomware-campaign use.

CVE-2026-15409 is a server-side request forgery (CWE-918) in the Work Place interface of SonicWall SMA1000 Series appliances. A remote attacker who can reach the Work Place interface, without any credentials, can submit a request that causes the appliance itself to issue a follow-on request to a location of the attacker's choosing, which can be used to reach internal-only services or interfaces behind the appliance (NVD).

NVD's vulnStatus for this record is Analyzed, but the only CVSS metric on file is a Secondary rating of 10.0 (critical) submitted by CISA's Authorized Data Publisher program, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network-reachable, low complexity, no authentication or user interaction, and a changed scope with high impact to confidentiality, integrity and availability. NVD has not published its own independent Primary CVSS score for this CVE (NVD).

NVD's CPE match data lists the vulnerable SMA1000 firmware builds as 12.4.3-03245, 12.4.3-03387, 12.4.3-03434, 12.5.0-02283, 12.5.0-02624 and 12.5.0-02800 across the SMA 6210, SMA 7210 and SMA 8200v models; it does not record a fixed build in the CPE configuration itself (NVD). Independent vulnerability reporting that reviewed SonicWall's own advisory SNWLID-2026-0008 states the fix shipped in builds 12.4.3-03453 (platform-hotfix) and 12.5.0-02835 (platform-hotfix) and later, with no workaround available prior to patching (techgines.com: SonicWall SMA1000 Zero-Day CVE-2026-15409 / CVE-2026-15410).

CISA added CVE-2026-15409 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-07-14, with a required-action due date of 2026-07-17, a forensic-triage requirement under BOD 26-04, and known ransomware-campaign use recorded as "Known" (CISA KEV).

As of 2026-10-30, FIRST scores the probability of exploitation at 0.0680 (93.991th percentile) (FIRST EPSS).

Because CISA's own catalog ties this flaw to ransomware activity and no workaround exists, any SMA 6210, 7210 or 8200v appliance on an affected build should be updated to 12.4.3-03453 / 12.5.0-02835 or later immediately and reviewed for signs of prior unauthorized access.

• Unauthenticated, remote SSRF in the Work Place interface of SonicWall SMA1000 Series appliances lets an attacker cause the appliance to make requests to an unintended location. — NVD
• CVSS v3.1 base score is 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — a CISA-ADP Secondary rating; NVD's vulnStatus is Analyzed but NVD has not published its own Primary score. — NVD
• Vulnerable SMA1000 firmware builds per NVD CPE data: 12.4.3-03245, 12.4.3-03387, 12.4.3-03434, 12.5.0-02283, 12.5.0-02624, 12.5.0-02800 across SMA 6210, SMA 7210 and SMA 8200v. — NVD
• SonicWall advisory SNWLID-2026-0008 fixes the flaw in builds 12.4.3-03453 (platform-hotfix) and 12.5.0-02835 (platform-hotfix) and later; no workaround is available prior to patching. — techgines.com
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-07-14, due date 2026-07-17, forensic-triage required under BOD 26-04, known ransomware-campaign use recorded as "Known". — CISA KEV
• EPSS score is 0.0680 (93.991th percentile) as of 2026-10-30. — FIRST EPSS