🔴 CVE-2026-15410

CVE-2026-15410 is a post-authentication OS command injection (CWE-94) vulnerability in the SonicWall SMA1000 Appliance Management Console (AMC) that allows a remote administrator-authenticated attacker to execute arbitrary OS commands on the appliance. The SMA1000 is a remote-access/VPN appliance that is commonly internet-facing, and this flaw is confirmed to be actively exploited in the wild and listed in CISA KEV.

← Back to Overview
HIGH_RISK
Risk Level
7.2
CVSS Score
NETWORK
Attack Vector
Initial Access
ATT&CK Tactic
T1190 — Exploit Public-Facing Application
ATT&CK Technique
HIGH
Deployment Risk
Yes (+62d)
Ransomware

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-07-14

Added to CISA KEV: 2026-07-14 0 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-15410 is a high-severity post-authentication code injection vulnerability residing in the Appliance Management Console (AMC) of SonicWall SMA 1000 Series appliances [1][2]. The flaw is critical because, under specific conditions, it allows a remote attacker who has already authenticated as an administrator to execute arbitrary operating system commands on the device, posing a significant risk to the integrity and security of the appliance and the network it protects [1].

Exploitation

  • Active Exploitation: This vulnerability has been confirmed as being actively exploited in the wild, often in conjunction with other flaws such as CVE-2026-15409 [2][3].
  • Threat Actors/Campaigns: Security reports note that these vulnerabilities have been targeted in zero-day attacks [3].
  • PoC/Tool Availability: While analysis of the vulnerability is public, specific details on weaponized proof-of-concept exploits are generally managed through security advisory channels [4].
  • Attack Prerequisites:
- Authentication: Required (attacker must be authenticated as an administrator) [1]. - Access: Remote network access to the Appliance Management Console (AMC) [1]. - User Interaction: None explicitly required once administrative access is obtained [1].

Affected Products & Patches

  • Affected Versions: SonicWall SMA 1000 Series running firmware versions 12.4.3 and 12.5.0 are confirmed to be impacted [2].
  • Patches/Hotfixes: SonicWall has released security updates to address this vulnerability; organizations are urged to apply the latest firmware patches provided by the official SonicWall support portal [3].
  • Mitigations: Restricting administrative access to the Management Console to trusted internal networks or VPN-only access can reduce the exposure to remote exploitation attempts.

Impact

  • Capability: Successful exploitation grants an authenticated administrator the ability to execute arbitrary OS commands, effectively providing full control over the appliance [1].
  • Business Risk: For internet-facing deployments, this vulnerability is critical as it allows compromised administrative credentials to be escalated into total system compromise, potentially leading to unauthorized data access, lateral movement into the internal corporate network, or complete service disruption [2].

Sources

  1. NVD-CVE-2026-15410

    CVE-2026-15410 Detail Description Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator t…

  2. Product Notice: SMA 1000 Series affected by Multiple Vulnerabilities

    Overview CVE-2026-15409: Server-Side Request Forgery – CVSS Score: 10.0 (Critical) CVE-2026-15410: Remote Code Execution – CVSS Score: 7.2 (High) SonicWall Secure Mobile Access 1000 Series 12.4.3 and 12.5.0 firmware (see impacted versions) are affected by this vulnerability. IMPORTANT: These vulnera…

  3. SonicWall SMA appliances targeted in zero-day attacks ...

    SonicWall has patched two actively exploited vulnerabilities (CVE-2026-15409, CVE-2026-15410) in its SMA 1000 Series appliances.

  4. CVE-2026-15410 & CVE-2026-15409 in SonicWall SMA

    CVE-2026-15410 is a post-authentication code injection flaw in the Appliance Management Console that can allow an authenticated admin-level ...

Generated by PatchNow Intelligence System

Analysis based on CIRCL.LU data, Claude AI assessment, and MITRE ATT&CK framework

📄 Download JSON Data | 📡 RSS Feed