[KEV] CVE-2026-15409 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2026-15409 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2026-15409 is a server-side request forgery (SSRF) vulnerability in SonicWall SMA1000 Appliances that can be triggered by a remote, unauthenticated attacker.

Technical Detail

The flaw exists in the SMA1000 appliance's request handling logic, where insufficient validation of user-supplied input allows an attacker to manipulate the appliance into issuing HTTP or network requests to arbitrary internal or external destinations. An unauthenticated remote attacker can exploit this without any credentials by sending a crafted request to the exposed interface. The practical impact includes potential access to internal network resources, metadata services, or backend systems that would otherwise be inaccessible from the external network, and the vulnerability may serve as a pivot point for further compromise of the environment.

Exploitation Status

CISA has confirmed active exploitation in the wild, with this vulnerability added to the Known Exploited Vulnerabilities catalog on July 14, 2026. The exploit maturity is rated Operational, meaning functional exploit code exists and is being used in real-world attacks, not merely demonstrated in a controlled research context. Organizations running SMA1000 appliances should treat this as an actively targeted vulnerability requiring immediate action.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor associations have been established in the available data. Given the nature of the affected product, a network edge appliance commonly deployed in enterprise and government environments, this class of vulnerability has historically attracted interest from both financially motivated actors and state-sponsored groups, but no specific attribution can be stated based on current information.

What To Do

Per CISA's binding operational directive associated with KEV listing on July 14, 2026, federal agencies are required to apply vendor-supplied patches or implement mitigations by the CISA-specified deadline. All organizations should apply the relevant SonicWall security update for SMA1000 Appliances immediately. If patching cannot be completed immediately, restrict external access to the SMA1000 management and user-facing interfaces at the network perimeter, and ensure the appliance cannot reach sensitive internal resources such as cloud metadata endpoints or internal management systems. Review appliance logs for anomalous outbound requests originating from the SMA1000, particularly to internal RFC1918 addresses or cloud instance metadata services, as these may indicate exploitation attempts. Contact SonicWall support for the specific patched firmware version applicable to your deployment.