🔴 CVE-2026-15409

Summary

CVE-2026-15409 is a critical Server-Side Request Forgery (SSRF) vulnerability affecting the Work Place interface of SonicWall SMA 1000 Series appliances. With a CVSS score of 10.0, this vulnerability is highly severe because it allows a remote, unauthenticated attacker to force the appliance to perform requests to internal, localhost-only locations, potentially exposing sensitive internal systems or services that are otherwise protected from external network access ^[1][2].

Exploitation

• Active Exploitation: The vulnerability has been confirmed as being actively exploited in the wild as a zero-day ^[1].
• Threat Actors: While specific ransomware groups or actors are not explicitly named in the advisory, the rapid exploitation and severity indicate advanced targeting of network infrastructure.
• Proof-of-Concept: Proof-of-concept (PoC) exploit code is publicly available and has been referenced by security researchers ^[3].
• Prerequisites: Exploitation is remote and does not require authentication; no user interaction is necessary for an attacker to initiate the malicious request ^[2][4].

Affected Products & Patches

• Affected Versions: SonicWall Secure Mobile Access (SMA) 1000 Series firmware versions 12.4.3 and 12.5.0 are confirmed as affected ^[1].
• Patches: SonicWall has released platform hotfix releases to address this vulnerability. Organizations should verify their firmware version and apply the latest provided hotfixes immediately ^[1].
• Mitigations: There are no widely recognized workarounds other than patching. Restricting access to the management/Work Place interface to trusted IP addresses may provide temporary defense-in-depth, but patching is the only complete remediation.

Impact

• Access and Capability: Successful exploitation allows an attacker to open a websocket-based tunnel to arbitrary localhost-only locations on the appliance. This bypasses network-level access controls, effectively allowing the attacker to interact with internal services hosted on the device or accessible from the device's internal context ^[2].
• Business Risk: For internet-facing deployments, this vulnerability poses a severe risk of initial access and network compromise. Attackers can leverage the SSRF to gain further internal network foothold, potentially leading to data theft, lateral movement, or full control over the appliance and connected secure segments ^[1].