[KEV] CVE-2026-15409 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2026-15409 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2026-15409 is a server-side request forgery (SSRF) vulnerability affecting SonicWall SMA1000 Appliances, exploitable by remote unauthenticated attackers without any prior access or credentials.

Technical Detail

The flaw exists in the SMA1000 appliance's handling of user-supplied input that is used to construct outbound requests, allowing an attacker to manipulate the appliance into issuing HTTP or network requests to arbitrary internal or external destinations. An unauthenticated remote attacker can trigger this condition by sending specially crafted requests to an exposed interface on the appliance. Depending on network topology, successful exploitation could be used to probe internal network resources, bypass perimeter controls, or serve as a pivot point for further attacks against systems not directly reachable from the internet.

Exploitation Status

CISA has confirmed active exploitation in the wild, having added this CVE to the Known Exploited Vulnerabilities catalog on July 14, 2026. The exploit maturity is rated Operational, meaning functional exploit code or techniques are in active use by threat actors, not merely demonstrated in a controlled research setting. Organizations running SMA1000 appliances should treat this as an actively targeted vulnerability requiring immediate action.

Who Is Targeting This

No confirmed threat actor attribution has been established at this time. Reported attribution is absent as well, with no public records, KEV annotations, CERT advisories, or vendor reports currently linking exploitation of this vulnerability to any named group or nation-state. Attribution remains unresolved and should be monitored as additional threat intelligence becomes available.

What To Do

Per CISA's binding operational directive associated with KEV listing on July 14, 2026, federal agencies are required to apply vendor-supplied patches or implement mitigations by the CISA-specified remediation deadline. All organizations should apply the relevant SonicWall security update for SMA1000 Appliances immediately. If patching cannot be completed without delay, restrict external access to the SMA1000 management and user-facing interfaces at the network perimeter, and limit the appliance's ability to make outbound connections to only explicitly required destinations. Monitor appliance logs for anomalous outbound request patterns, unexpected DNS lookups, or connections to internal RFC 1918 address space that do not correspond to legitimate user activity. Check SonicWall's official security advisory for specific affected firmware versions and confirmed patch availability.