SonicWall SMA1000 Work Place SSRF (CVE-2026-15409)

SonicWall's advisory SNWLID-2026-0008 describes CVE-2026-15409 as a server-side request forgery (SSRF) in the SMA1000 Work Place interface. A remote unauthenticated attacker "could potentially cause the appliance to make requests to unintended location," in the advisory's words. SonicWall rates it CVSS 3.0 10.0 Critical.

SonicWall says its PSIRT investigated multiple cases that indicate active exploitation of the flaws in this advisory. CISA added the CVE to its Known Exploited Vulnerabilities catalog on 14 July 2026, the day SonicWall published the advisory.

The Companion Flaw CVE-2026-15410

The advisory covers a second flaw, CVE-2026-15410, a post-authentication code injection in the Appliance Management Console (AMC). An administrator login is required and SonicWall rates it CVSS 3.0 7.2 High. CISA lists CVE-2026-15410 in KEV as well.

What the Researcher Repositories Claim

This section shows what third parties claim, and we did not run any of the code. The author of a repository created on 15 July 2026 claims a proof of concept that tunnels the Erlang protocol on localhost port 1050 through the websocket. This is the author's own claim.

The author of another repository claims a framework that chains the SSRF to Erlang remote calls and then to root. These descriptions are the authors' own claims. The advisory's log indicators do mention requests to a /wsproxy path.

Indicators SonicWall Lists

SonicWall tells customers to review logs for several signs. In extraweb_access.log, look for requests to /__api__/login or /__api__/logout with HTTP 200, and requests to /wsproxy with suspicious host parameters and HTTP 101. In ctrl-service.log, look for hotfix rollbacks with path traversal names.

The file /var/lib/unit/conf.json should not contain routes for /__api__/login or /__api__/logout, because SonicWall says these URIs do not exist in a legitimate configuration. SonicWall credits Volexity researchers with helping to identify an additional indicator. Our indicator of compromise entry explains how to use such lists.

The Same Product Was Hit Again in September

The fix builds of this CVE, 12.4.3-03453 and 12.5.0-02835, are the newest builds that SonicWall's September advisory lists as affected by CVE-2026-83548. That later pre-authentication SSRF is also in KEV. Patching in July did not close the second flaw.

What Public Sources and Our Checks Show

We checked the catalogues and public sources on 4 November 2026. SonicWall's advisory states the exploitation, and the table adds the ransomware flag, public code claims and dark web mentions.

The earliest exploit claim is a repository created on 15 July. A 15 July placeholder and a 16 July unofficial log checker are not exploit code.

Many Blackhole posts come from automated CVE alert feeds, so the count shows attention and not attacks. CISA's ransomware flag is a catalogue field. Our KEV and ransomware analysis shows how often that flag appears.

SonicWall lists the SMA1000 models 6210, 7210 and 8200v on six platform-hotfix builds. The advisory says the flaws do not affect SSL-VPN on SonicWall firewalls or the SMA 100 Series. SonicWall names no workaround.

SonicWall says the latest platform hotfix is on mysonicwall.com. The CVE record names Linux as the platform. NVD lists the same six builds for the 6210 and 7210 models.

SonicWall recommends a forensic analysis for every affected appliance. If indicators appear, it says to re-image hardware or re-deploy virtual appliances, change user and administrator passwords and reset TOTP tokens.

The fixed builds here are not the end of the story. SonicWall's September advisory lists 12.4.3-03453 and 12.5.0-02835 as affected by CVE-2026-83548, so a host needs the later hotfix too. Our vulnerability management guide covers how to track such repeat fixes.