CVE-2026-15410 is a post-authentication code-injection flaw in the SonicWall SMA1000 appliance management console that lets an administrator-level session run arbitrary OS commands, and it was weaponized in the wild as the second step of a chain starting from the unauthenticated SSRF CVE-2026-15409, discovered during a Rapid7 MDR investigation.
Vulnerability summary
7.2
High
11.8%
EPSS score (FIRST)
Yes
CISA KEV catalog
2026-07-14
Published
Vulnerability ID: CVE-2026-15410 · Source: SonicWall PSIRT (not NVD-confirmed)
Affected components
| Component | CPE | Version range |
|---|---|---|
| SonicWall SMA1000 (SMA 6210, 7210, 8200v) firmware | cpe:2.3:o:sonicwall:sma1000_firmware:*:*:*:*:*:*:*:* | 12.4.3-03245 through 12.4.3-03434; 12.5.0-02283 through 12.5.0-02800 |
What this means
CVE-2026-15410 is a CWE-94 (Improper Control of Generation of Code) vulnerability in the SonicWall SMA1000 Appliance Management Console. NVD's description states the flaw is a "post-authentication code injection" issue that lets "an authenticated administrator execute arbitrary OS commands" on affected SMA1000 firmware (NVD).
NVD lists only a Secondary CVSS v3.1 score (source identifier 134c704f-9b21-4f2e-91b3-4a467353bcc0): base score 7.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H — network-reachable, low complexity, but high privileges (administrator) required. NVD's status is "Analyzed," with no NVD Primary metric published, so this score is labelled not NVD-confirmed on this page (NVD).
SonicWall's PSIRT advisory SNWLID-2026-0008 covers the affected SMA1000 firmware builds listed above and ties CVE-2026-15410 to a chained attack: Rapid7's Managed Detection and Response team observed threat actors first exploiting an unauthenticated SSRF vulnerability, CVE-2026-15409 (CVSS 10.0), to reach the administrative interface, then using CVE-2026-15410's code-injection flaw to execute commands as root on internet-facing SMA1000 appliances (SonicWall PSIRT Advisory SNWLID-2026-0008).
CISA added CVE-2026-15410 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-07-14, with a required-action due date of 2026-07-17 — a three-day window reflecting the severity of a fully chained, unauthenticated-to-root attack path on a remote-access appliance — confirmed present in the live KEV catalog's CVE-filtered view this run (CISA KEV).
As of 2026-10-30, FIRST scores the probability of exploitation at 0.11791 (96.076th percentile) — high relative to most CVEs, consistent with SMA1000's role as a frequently targeted, internet-exposed SSL-VPN/remote-access front door (FIRST EPSS).
Any SMA1000 appliance (SMA 6210, 7210 or 8200v) on the affected firmware ranges should be patched immediately and treated as potentially compromised if internet-facing, since this bug is most dangerous as the second half of a complete unauthenticated-to-root chain with CVE-2026-15409 rather than as a standalone issue.
Evidence
- Post-authentication code injection (CWE-94) in the SonicWall SMA1000 Appliance Management Console lets an authenticated administrator execute arbitrary OS commands. — NVD
- NVD lists only a Secondary CVSS v3.1 score of 7.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H; no NVD Primary metric is published. — NVD
- Affects SMA1000 (SMA 6210/7210/8200v) firmware 12.4.3-03245 through 12.4.3-03434 and 12.5.0-02283 through 12.5.0-02800; Rapid7 MDR observed the flaw chained after the unauthenticated SSRF CVE-2026-15409 to reach the admin interface before running commands as root. — SonicWall PSIRT Advisory SNWLID-2026-0008
- Added to the CISA KEV catalog on 2026-07-14, required-action due date 2026-07-17. — CISA KEV
- EPSS score is 0.11791 (96.076th percentile) as of 2026-10-30. — FIRST EPSS
