DaystoPatch

SonicWallExploited incident

SonicWall SMA1000 Work Place SSRF chained with AMC code injection (zero-day)

CVE-2026-15409, CVE-2026-15410Critical, CVSS 10.0In CISA's Known Exploited Vulnerabilities catalog since 14 Jul 2026

  • Exploited before a fix
  • Known ransomware use
FixedFixed for every supported version on the day it became public.
Embed this live clock

Response

Silence
0h
First public report to first vendor statement
Exposure
0h
First public report to first fix
Follow-through
0h
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    SonicWall PSIRT SNWLID-2026-0008 (PSIRT API record)CuratedQuote verified

    SonicWall PSIRT has investigated multiple cases indicating the active exploitation of the vulnerabilities described in this advisory.

    Published 2026-07-14T14:43:22Z per the same record. Volexity later traced activity back to 2026-06-22, but no public report before the advisory was found.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b6702e676e6a1371…
    Used in metrics
    Yes
    Dispute this timestamp
    8 more sources for this moment
    CISA KEV (CVE-2026-15409)ClaimedQuote verified14 Jul 2026

    SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

    Added to CISA's KEV catalog on 2026-07-14.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2026-15410)ClaimedQuote verified14 Jul 2026

    SonicWall SMA1000 Appliances Code Injection Vulnerability

    Added to CISA's KEV catalog on 2026-07-14.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    SonicWall advisory SNWLID-2026-0008ClaimedQuote verified14 Jul 2026, 14:43 UTC

    1) CVE-2026-15409 - A Server-side request forgery (SSRF)

    The vendor's own disclosure.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:52676cf16c4037e9…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet14 Jul 2026, 17:48 UTC

    SonicWallのSMAアプライアンスがゼロデイ攻撃の標的に(CVE-2026-15409、CVE-2026-15410)

    Earliest third-party post we hold. An independent author on another platform posted within 48 hours. Used for unreviewed incidents only, never graded.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet14 Jul 2026, 18:06 UTC

    SonicWall SMA1000 zero-days chain unauth SSRF into AMC code injection for root on your VPN box. 9 detections, 25 IOCs. Full analysis + IOCs: https:// intel.threadlinqs.com/threat/T L-2026-1323 #

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-15409ClaimedQuote verified14 Jul 2026, 19:39 UTC

    A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:0e3c1878d3874b76…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Hacker NewsClaimedQuote not checked yet15 Jul 2026, 18:53 UTC

    CVE-2026-15409: SonicWall SMA 1000 SSRF Zero-Day

    Earliest third-party post we hold. An independent author on another platform posted within 48 hours. Used for unreviewed incidents only, never graded.

    Source
    Hacker News hn
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Research: volexityClaimedQuote verified17 Jul 2026, 22:10 UTC

    were patched through a hotfix earlier this week and included in versions 12.4.3-03453 and 12.5.0-02835 of the appliance: CVE-2026-15409 (SSRF) CVE-2026-15410 (Command Injection) At the beginning of the investigation, Volexity initially worked with available security telemetry and logs exported from

    Earliest mention we hold (a vetted outlet).

    Source
    Research: volexity research
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:67e4b8f33d82c4b8…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    SonicWall advisory SNWLID-2026-0008ClaimedQuote verified

    1) CVE-2026-15409 - A Server-side request forgery (SSRF)

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:52676cf16c4037e9…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    SonicWall PSIRT SNWLID-2026-0008 (PSIRT API record)CuratedQuote verified14 Jul 2026, 14:43 UTC

    "published_when":"2026-07-14T14:43:22Z"

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b6702e676e6a1371…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    at disclosure

    SonicWall PSIRT SNWLID-2026-0008 (PSIRT API record)CuratedQuote verified

    12.4.3-03453 (platform-hotfix) and higher versions.

    Hotfixes were in the initial release; the only later revision (1.1, same day) updated the credits. Upper bound: fixed builds may have shipped earlier; only the date shown here is evidenced (R2).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b6702e676e6a1371…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    at disclosure

    SonicWall PSIRT SNWLID-2026-0008 (PSIRT API record)CuratedQuote verified

    12.5.0-02835 (platform-hotfix) and higher versions.

    Both affected branches (12.4.3 and 12.5.0) had platform hotfixes at publication.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b6702e676e6a1371…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

SonicWall SMA1000 zero-days used by ransomware actors, fixed Jul 14

Attackers chained two SMA1000 flaws to run commands as root on remote-access appliances for weeks before SonicWall released hotfixes on 14 July 2026.

In plain words

SonicWall's SMA1000 remote access appliance had two flaws that attackers, including a group tied to ransomware, used to take over devices for about three weeks before a fix existed. SonicWall released fixes on 14 July 2026. If we use an SMA1000, it must be updated and checked for signs of compromise, and rebuilt with all passwords reset if anything is found.

What happened and who is affected

What happened

On 14 July 2026 SonicWall disclosed CVE-2026-15409, an unauthenticated server-side request forgery in the SMA1000 Work Place interface (CVSS 10.0), and CVE-2026-15410, a code injection in the Appliance Management Console, and said it had investigated multiple cases of active exploitation. Volexity traced the activity to 22 June 2026, and Rapid7 linked it to an actor connected to the Inc ransomware group. Platform hotfixes were released with the advisory.

Who is affected

SonicWall SMA1000 appliances (6210, 7210, 8200v; physical and virtual) on 12.4.3-03245, 12.4.3-03387, 12.4.3-03434, 12.5.0-02283, 12.5.0-02624 or 12.5.0-02800. SMA 100 and firewall SSL-VPN are not affected.

CVE-2026-15409, CVE-2026-15410. Reviewed 22 Oct 2026. https://daystopatch.com/incidents/sonicwall-cve-2026-15409/

Affected products

  • SMA1000 (6210, 7210, 8200v)
How we built this timeline

Zero-day acknowledged in the first publication. Volexity (UTA0533, activity from 22 Jun 2026) helped SonicWall's investigation and is credited in revision 1.1 (same day).

Rapid7 tied exploitation to an Inc ransomware-linked actor; KEV marks ransomware use Known for both CVEs.

CVSS: 10.0 (CVE-2026-15409), 7.2 (CVE-2026-15410). Workaround: the advisory says 'None.' The human-readable advisory page is a JavaScript app; the PSIRT JSON API record is cited.

A later SMA1000 advisory (SNWLID-2026-0016, 1 Sep 2026) fixed further exploited flaws in these same hotfix builds.

Related

SonicWall report card