CVE-2026-15409

● KEV CRITICAL

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make...

Affects 0 products across 1 vendor.

CVSS 3.110.0
EPSS6.8%
Percentile94th
PatchUnknown
KEV Added2026-07-14
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-918: Server-Side Request Forgery (SSRF)

Attacker causes the server to make HTTP requests to attacker-chosen destinations, potentially reaching internal services.

Related Attack Patterns (CAPEC)
CAPEC-664 Server Side Request Forgery
via CWE-918

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A critical severity vulnerability (CVE-2026-15409) affects the target system. A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2026-15409?
A critical severity vulnerability (CVE-2026-15409) affects the target system. A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.
What is the CVSS score for CVE-2026-15409?
CVE-2026-15409 has CVSS 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS: 6.8%.
Is CVE-2026-15409 actively exploited?
Yes. CVE-2026-15409 is in the CISA KEV catalog (added 2026-07-14). Active exploitation confirmed. Immediate patching required.
How do I remediate CVE-2026-15409?
Apply vendor patches for CVE-2026-15409. Monitor Sonicwall advisories.
What systems are affected by CVE-2026-15409?
CVE-2026-15409 affects: Sonicwall.
Vulnerability Details
CVE IDCVE-2026-15409
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published2026-07-14
Last Modified2026-07-16
ICS Relevance90%
Weakness (CWE)
Server-Side Request Forgery (SSRF)
SourceNVD
Official Description

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.

Source: NIST NVD / MITRE CVE Database

Affected Products
VendorProductFixed Version
Sonicwall — —
Remediation

No patch URL on record. Monitor vendor security advisories directly.

Threat Intelligence
● Threat Intelligence Validated: September 2026 | Threat Age: 75 Days
CISA KEV● Active Exploitation Confirmed (added 2026-07-14)
Public ExploitNot confirmed
PoC CodeNot confirmed
Related CVEs affecting Sonicwall
CVE-2026-83548 10.0 A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work ... CVE-2007-5815 10.0 Absolute path traversal vulnerability in the WebCacheCleaner ActiveX control ... CVE-2021-44228 10.0 Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2... CVE-2016-2396 9.9 The GMS ViewPoint (GMSVP) web application in Dell SonicWALL GMS, Analyzer, an... CVE-2016-2397 9.8 The cliserver implementation in Dell SonicWALL GMS, Analyzer, and UMA EM5000 ...
View all Sonicwall CVEs →

This Vulnerability Is Being Actively Exploited

CVE-2026-15409 is on the CISA KEV list - confirmed active exploitation in the wild. BreachSpider flags known-exploited CVEs on the ICS assets they affect, with known-exploited status synced daily from CISA.

Create a free account →