Skip to content
VulniPulse
Sign in
Highest advisory severityCritical Exploited CISA KEV 1 vendor · 1 advisory

CVE-2026-15409

SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

CVE-2026-15409: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability. In CISA KEV since 2026-07-14; known ransomware use.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

CVE-2026-15409 at a glance

CISA KEV
Listed on · federal remediation due
Ransomware use
Known ransomware campaign use, according to CISA
Highest advisory severity
Critical
Vendor advisories
1 from SonicWall
VulniPulse record
Published · Updated

Is CVE-2026-15409 exploited?

Yes. CISA lists CVE-2026-15409 in its Known Exploited Vulnerabilities catalog (added ), which means CISA has evidence of exploitation in the wild. CISA also reports known use in ransomware campaigns.

How do I fix CVE-2026-15409?

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

This CVE is tracked through a multi-CVE bulletin, so its fixed releases may differ from the bulletin-wide values below. Check the vendor source.

Vendor advisory comparison

SonicWall

1 advisory
  • Advisory severityCritical10.0

    Critical [CVE-2026-15409 +1] Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface.

    SNWLID-2026-0008Source published Source updated

    This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

    A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.

    Affected products in this advisory
    • SMA1000
    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

Android app · Google Play

Monitor future SonicWall CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features