SonicWall SMA1000 CVE-2026-15409 and CVE-2026-15410 actively exploited vulnerabilities: actively exploited vulnerability added to CISA KEV

Confirmed
Discovered Jul 14, 2026

CISA added CVE-2026-15409, CVE-2026-15410 affecting SonicWall SMA1000 Series Appliances to the Known Exploited Vulnerabilities catalog on 2026-07-14. This post scopes exposure, fixed-version evidence, and IR handling without treating advisory sites as IOCs.

8
Affected Packages
4
Observables
4
Sources

Defender Action Panel

Triage this incident quickly

Check whether your environment installed affected software, copy the top IOCs, run the tested hunting script when available, then review remediation guidance.

Current dossier state
needs review
Last verified
Not yet independently verified
Am I affected?
sonicwall-sma1000, sonicwall-sma1000, sonicwall-sma1000@12.4.3-03434, sonicwall-sma1000
Immediate action
Audit locks, CI runners, developer workstations, and credential exposure.
Hunting
Has hunting script
Observed fact
Direct-source and cited evidence only.
Informed inference
Analysis is labelled where evidence is indirect.
Unknown
Unverified scope remains explicitly open.
SMA1000 Series Appliances
SonicWall
CVE-2026-15409
CVE-2026-15410

Analysis

Executive Summary

CISA added CVE-2026-15409, CVE-2026-15410 for SonicWall SMA1000 Series Appliances to the Known Exploited Vulnerabilities catalog on 2026-07-14, which is the active-exploitation gate for this Halting Problems entry [1]. SonicWall PSIRT advisory SNWLID-2026-0008 describes an unauthenticated SSRF in the SMA1000 Work Place interface and a post-authentication administrator code-injection issue in the SMA1000 Appliance Management Console. SonicWall says PSIRT investigated multiple cases involving SMA1000 appliances and published product-specific IOCs and recovery actions. [2]

This entry is intentionally evidence-conservative. The public sources reviewed for this automated refresh provide active-exploitation status, product identity, fixed-version or hotfix evidence where available, and vulnerability metadata, but they do not publish attacker-controlled infrastructure, file hashes, victim counts, or a campaign name. Source and advisory URLs are therefore kept as source selectors rather than IOC values.

Key Facts

CVE: CVE-2026-15409, CVE-2026-15410

Vendor: SonicWall

Product: SMA1000 Series Appliances

KEV Added: 2026-07-14

KEV Due Date: 2026-07-17

Affected / Fixed Version Selectors:

  • sonicwall-sma1000@12.4.3-03245
  • sonicwall-sma1000@12.4.3-03387
  • sonicwall-sma1000@12.4.3-03434 platform-hotfix
  • sonicwall-sma1000@12.5.0-02283
  • sonicwall-sma1000@12.5.0-02624
  • sonicwall-sma1000@12.5.0-02800 platform-hotfix
  • fixed: sonicwall-sma1000 >= 12.4.3-03453 platform-hotfix
  • fixed: sonicwall-sma1000 >= 12.5.0-02835 platform-hotfix

CVSS: 10.0 CRITICAL for CVE-2026-15409; 7.2 HIGH for CVE-2026-15410

Evidence Assessment

Analysis table
ClaimStatusEvidence
CISA lists CVE-2026-15409, CVE-2026-15410 as exploited in the wild for SonicWall SMA1000 Series Appliances.confirmedCISA KEV entries name SonicWall and SMA1000 Series Appliances and record date added 2026-07-14 [1].
Vendor or NVD sources describe the vulnerability and affected product family.confirmedVendor/NVD enrichment reviewed in this run provides the description, severity, and affected/fixed selectors summarized above [2].
Public sources identify attacker infrastructure, hashes, or campaign attribution.not_observedCISA KEV, NVD, and linked vendor references reviewed during this run do not publish those IOC classes.

Impact Determination

Treat internet-exposed, identity-integrated, or administrative SMA1000 Series Appliances systems as high-priority until version and mitigation evidence are captured. Affected systems require product log review, host-level timeline preservation, and a post-fix scan. If exploitation succeeded, defenders should decide whether sessions, API keys, service credentials, or product-managed secrets could have been accessed or abused from the compromised host.

Detection and Hunting

The reviewed hunt manifest ships with scripts/scope_sonicwall-sma1000-cve-2026-15409-cve-2026-15410-kev.py. It scans asset inventories and exported logs for CVE-2026-15409, CVE-2026-15410, SonicWall, SMA1000 Series Appliances, affected/fixed-version selectors, and product-specific telemetry patterns from the sources. Use it against CMDB exports, scanner exports, EDR file/log bundles, web server logs, appliance logs, product logs, and incident evidence collected in a forensics-safe workspace.

Positive findings are scope signals, not proof of compromise. Escalate to product-specific IR by preserving UTC timelines, snapshots or hashes of relevant configs and logs, evidence owner, collection time, and chain-of-custody notes.

Remediation and Recovery Gates

  1. Review extraweb_access.log for requests to /__api__/login or /__api__/logout with HTTP 200 status and for /wsproxy requests with suspicious host parameters and HTTP 101 status.
  2. Review ctrl-service.log for hotfix rollbacks with path-traversal-like names and preserve the log with hashes and collection timestamps.
  3. Inspect /var/lib/unit/conf.json for unexpected routes for /__api__/login or /__api__/logout; SonicWall says those URIs do not exist in legitimate configuration.
  4. Upgrade to fixed platform-hotfix 12.4.3-03453 or higher, or 12.5.0-02835 or higher, then capture before/after version evidence.
  5. If IOCs are present, re-image hardware appliances or redeploy virtual appliances, change user and administrator passwords, reset TOTP tokens, and review connected identity/session material.
  6. Maintain UTC chain-of-custody notes, snapshots, hashes, evidence owner, and post-recovery monitoring for recurrence.

Indicators of Compromise

No attacker-controlled domains, URLs, hashes, or IP addresses were published by the sources reviewed for this entry. Machine-readable IOC fields are intentionally empty for those classes.

Open Questions

  • Which exploitation clusters are using CVE-2026-15409, CVE-2026-15410 in the wild?
  • Are there reliable product-specific log signatures beyond public vendor guidance and exposure scoping selectors?
  • Did vendor or researcher sources publish additional affected/fixed-version detail after this automated refresh?

Sources

Timeline

6 of 6 rows

Timeline
DateEventDescriptionSource
Jul 14, 2026First seenFirst seen recorded for SonicWall SMA1000 CVE-2026-15409 and CVE-2026-15410 actively exploited vulnerabilities.cisa.gov
Jul 14, 2026Patch or fixPatch or fix recorded for SonicWall SMA1000 CVE-2026-15409 and CVE-2026-15410 actively exploited vulnerabilities.cisa.gov
Jul 14, 2026DiscoveryDiscovery recorded for SonicWall SMA1000 CVE-2026-15409 and CVE-2026-15410 actively exploited vulnerabilities.cisa.gov
Jul 14, 2026DisclosureDisclosure recorded for SonicWall SMA1000 CVE-2026-15409 and CVE-2026-15410 actively exploited vulnerabilities.cisa.gov
Jul 17, 2026kev due datekev due date recorded for SonicWall SMA1000 CVE-2026-15409 and CVE-2026-15410 actively exploited vulnerabilities.cisa.gov
Jul 14, 2026SonicWall SMA1000 CVE-2026-15409 and CVE-2026-15410 actively exploited vulnerabilities: actively exploited vulnerability added to CISA KEVUnknowncisa.gov

Affected Software

8 of 8 rows

Affected Software
PackageEcosystemVersion RangeStatusConfidenceSource
sonicwall-sma1000enterprise-software12.4.3-03245Malicious90%cisa.gov; nvd.nist.gov; psirt.global.sonicwall.com; psirtapi.global.sonicwall.com
sonicwall-sma1000enterprise-software12.4.3-03387Malicious90%cisa.gov; nvd.nist.gov; psirt.global.sonicwall.com; psirtapi.global.sonicwall.com
sonicwall-sma1000@12.4.3-03434enterprise-softwareplatform-hotfixMalicious90%cisa.gov; nvd.nist.gov; psirt.global.sonicwall.com; psirtapi.global.sonicwall.com
sonicwall-sma1000enterprise-software12.5.0-02283Malicious90%cisa.gov; nvd.nist.gov; psirt.global.sonicwall.com; psirtapi.global.sonicwall.com
sonicwall-sma1000enterprise-software12.5.0-02624Malicious90%cisa.gov; nvd.nist.gov; psirt.global.sonicwall.com; psirtapi.global.sonicwall.com
sonicwall-sma1000@12.5.0-02800enterprise-softwareplatform-hotfixMalicious90%cisa.gov; nvd.nist.gov; psirt.global.sonicwall.com; psirtapi.global.sonicwall.com
fixed:enterprise-softwaresonicwall-sma1000 >= 12.4.3-03453 platform-hotfixMalicious90%cisa.gov; nvd.nist.gov; psirt.global.sonicwall.com; psirtapi.global.sonicwall.com
fixed:enterprise-softwaresonicwall-sma1000 >= 12.5.0-02835 platform-hotfixMalicious90%cisa.gov; nvd.nist.gov; psirt.global.sonicwall.com; psirtapi.global.sonicwall.com

IOC Clipboard

4 IOCs
commandSMA1000 Series Appliances
commandSonicWall
commandCVE-2026-15409
commandCVE-2026-15410

Tested Hunting Scripts

1 of 1 rows

Tested Hunting Scripts
TitleLanguageDescriptionRepositorySource
CVE-2026-15409/CVE-2026-15410 asset and telemetry scopePythonDo inventories/logs contain CVE-2026-15409, CVE-2026-15410, SonicWall, SMA1000 Series Appliances, affected-version, or telemetry selectors?scripts/scope_sonicwall-sma1000-cve-2026-15409-cve-2026-15410-kev.py opens in a new tabcisa.gov

Hunt Manifest: CVE-2026-15409/CVE-2026-15410 asset and telemetry scope

Title
CVE-2026-15409/CVE-2026-15410 asset and telemetry scope
Question
Do inventories/logs contain CVE-2026-15409, CVE-2026-15410, SonicWall, SMA1000 Series Appliances, affected-version, or telemetry selectors?
Telemetry Family
Python
Repository
scripts/scope_sonicwall-sma1000-cve-2026-15409-cve-2026-15410-kev.py
Show tested hunting scriptscripts/scope_sonicwall-sma1000-cve-2026-15409-cve-2026-15410-kev.py
scripts/scope_sonicwall-sma1000-cve-2026-15409-cve-2026-15410-kev.py opens in a new tabPython
#!/usr/bin/env python3
"""Scope CVE-2026-15409/CVE-2026-15410 exposure from local inventories and exported logs."""
from __future__ import annotations
import json, os, sys
from pathlib import Path
CVE_IDS=['CVE-2026-15409', 'CVE-2026-15410']
VENDOR='SonicWall'
PRODUCT='SMA1000 Series Appliances'
AFFECTED_VERSION_SELECTORS=['sonicwall-sma1000@12.4.3-03245', 'sonicwall-sma1000@12.4.3-03387', 'sonicwall-sma1000@12.4.3-03434 platform-hotfix', 'sonicwall-sma1000@12.5.0-02283', 'sonicwall-sma1000@12.5.0-02624', 'sonicwall-sma1000@12.5.0-02800 platform-hotfix', 'fixed: sonicwall-sma1000 >= 12.4.3-03453 platform-hotfix', 'fixed: sonicwall-sma1000 >= 12.5.0-02835 platform-hotfix']
SOURCE_SELECTORS=['https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json', 'https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008', 'https://psirtapi.global.sonicwall.com/api/v1/vulndetail/?advisory_id=SNWLID-2026-0008', 'https://nvd.nist.gov/vuln/detail/CVE-2026-15409', 'https://nvd.nist.gov/vuln/detail/CVE-2026-15410', 'https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409', 'https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15410']
DOMAINS=[]; HASHES=[]; URLS=[]; FILES=[]; NETWORK_PATTERNS=[]
PROCESS_PATTERNS=['SMA1000 Series Appliances', 'SonicWall', 'CVE-2026-15409', 'CVE-2026-15410']
PRODUCT_TELEMETRY_PATTERNS=['extraweb_access.log', '/__api__/login', '/__api__/logout', '/wsproxy', 'ctrl-service.log', 'hotfix rollbacks', '/var/lib/unit/conf.json', 'platform-hotfix']
INDICATORS=list(dict.fromkeys(CVE_IDS+[VENDOR,PRODUCT]+AFFECTED_VERSION_SELECTORS+SOURCE_SELECTORS+PRODUCT_TELEMETRY_PATTERNS))
OUT=os.environ.get('OUT','hp-sonicwall-sma1000-cve-2026-15409-cve-2026-15410-kev-scope')
TEXT_SUFFIXES={'.csv','.json','.jsonl','.txt','.log','.yaml','.yml','.xml','.conf','.ini','.md'}
EXCLUDED_DIR_NAMES={'.git','node_modules','vendor','dist','__pycache__','.venv'}
def read_text(path: Path)->str:
    try: return path.read_text(encoding='utf-8', errors='ignore')
    except Exception: return ''
def iter_files(root: Path):
    if root.is_file(): yield root; return
    for p in root.rglob('*'):
        if p.is_file() and not any(part in EXCLUDED_DIR_NAMES for part in p.parts):
            if not p.suffix or p.suffix.lower() in TEXT_SUFFIXES: yield p
def scan(root: Path):
    matches=[]; lowered=[s.lower() for s in INDICATORS if s]
    for path in iter_files(root):
        low=read_text(path).lower(); hits=sorted({INDICATORS[i] for i,s in enumerate(lowered) if s in low})
        if hits: matches.append({'path':str(path),'hits':hits})
    return matches
def main(argv=None):
    argv=argv or sys.argv[1:]; root=Path(argv[0]) if argv else Path('.')
    matches=scan(root); out_dir=Path(OUT); out_dir.mkdir(parents=True, exist_ok=True)
    report={'cves':CVE_IDS,'vendor':VENDOR,'product':PRODUCT,'affected_version_selectors':AFFECTED_VERSION_SELECTORS,'match_count':len(matches),'matches':matches}
    (out_dir/'scope_report.json').write_text(json.dumps(report,indent=2),encoding='utf-8')
    print(json.dumps({'cves':CVE_IDS,'match_count':len(matches),'report':str(out_dir/'scope_report.json')},indent=2))
    return 2 if matches else 0
if __name__=='__main__': raise SystemExit(main())

Provenance & Sources

4 of 4 rows

Provenance & Sources
SourceTypeReliabilityClaimsEvidence
cisa.govSecurity Researcher95%3CISA added CVE-2026-15409, CVE-2026-15410 affecting SonicWall SMA1000 Series Appliances to the Known Exploited Vulnerabilities catalog on 2026-07-14. This post scopes exposure, fixed-version evidence, and IR handling without treating advisory sites as IOCs.
nvd.nist.govSecurity Researcher95%2CISA added CVE-2026-15409, CVE-2026-15410 affecting SonicWall SMA1000 Series Appliances to the Known Exploited Vulnerabilities catalog on 2026-07-14. This post scopes exposure, fixed-version evidence, and IR handling without treating advisory sites as IOCs.
psirt.global.sonicwall.comSecurity Researcher95%1CISA added CVE-2026-15409, CVE-2026-15410 affecting SonicWall SMA1000 Series Appliances to the Known Exploited Vulnerabilities catalog on 2026-07-14. This post scopes exposure, fixed-version evidence, and IR handling without treating advisory sites as IOCs.
psirtapi.global.sonicwall.comSecurity Researcher95%1CISA added CVE-2026-15409, CVE-2026-15410 affecting SonicWall SMA1000 Series Appliances to the Known Exploited Vulnerabilities catalog on 2026-07-14. This post scopes exposure, fixed-version evidence, and IR handling without treating advisory sites as IOCs.