Read the docs
TI-2026-12965 Aliases CVE-2026-15409GHSA-35rc-2vcv-r6q5

Server-side request forgery in SonicWall SMA1000

Priority CRITICAL 100Exploited in the wildCWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.

Why it matters now

Exploitation Active In CISA KEV since 2026-07-14CISA due date 2026-07-17Known ransomware use
EPSS 0.06795 94th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SonicWallSMA100012.4.3-03245 – 12.4.3-03434; 12.5.0-02283 – 12.5.0-02800—No fix listedCNA
  • SMA1000 VendorSonicWall Affected 12.4.3-03245 – 12.4.3-03434; 12.5.0-02283 – 12.5.0-02800 Fixed in — No fix listed CNA

CPE configurations NVD · 21

CPEVersionsRoleVendor
cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03245:*:*:*:*:*:*:*12.4.3-03245VulnerableSonicWall
cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03387:*:*:*:*:*:*:*12.4.3-03387VulnerableSonicWall
cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03434:*:*:*:*:*:*:*12.4.3-03434VulnerableSonicWall
cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02283:*:*:*:*:*:*:*12.5.0-02283VulnerableSonicWall
cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02624:*:*:*:*:*:*:*12.5.0-02624VulnerableSonicWall
cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02800:*:*:*:*:*:*:*12.5.0-02800VulnerableSonicWall
cpe:2.3:h:sonicwall:sma6210:-:*:*:*:*:*:*:*not specified by NVDRunning onSonicWall
cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03245:*:*:*:*:*:*:*12.4.3-03245VulnerableSonicWall
cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03387:*:*:*:*:*:*:*12.4.3-03387VulnerableSonicWall
cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03434:*:*:*:*:*:*:*12.4.3-03434VulnerableSonicWall
  • cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03245:*:*:*:*:*:*:* Versions 12.4.3-03245 Vulnerable ·SonicWall
  • cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03387:*:*:*:*:*:*:* Versions 12.4.3-03387 Vulnerable ·SonicWall
  • cpe:2.3:o:sonicwall:sma6210_firmware:12.4.3-03434:*:*:*:*:*:*:* Versions 12.4.3-03434 Vulnerable ·SonicWall
  • cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02283:*:*:*:*:*:*:* Versions 12.5.0-02283 Vulnerable ·SonicWall
  • cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02624:*:*:*:*:*:*:* Versions 12.5.0-02624 Vulnerable ·SonicWall
  • cpe:2.3:o:sonicwall:sma6210_firmware:12.5.0-02800:*:*:*:*:*:*:* Versions 12.5.0-02800 Vulnerable ·SonicWall
  • cpe:2.3:h:sonicwall:sma6210:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SonicWall
  • cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03245:*:*:*:*:*:*:* Versions 12.4.3-03245 Vulnerable ·SonicWall
  • cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03387:*:*:*:*:*:*:* Versions 12.4.3-03387 Vulnerable ·SonicWall
  • cpe:2.3:o:sonicwall:sma7210_firmware:12.4.3-03434:*:*:*:*:*:*:* Versions 12.4.3-03434 Vulnerable ·SonicWall
Show 11 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:sonicwall:sma7210_firmware:12.5.0-02283:*:*:*:*:*:*:*12.5.0-02283VulnerableSonicWall
cpe:2.3:o:sonicwall:sma7210_firmware:12.5.0-02624:*:*:*:*:*:*:*12.5.0-02624VulnerableSonicWall
cpe:2.3:o:sonicwall:sma7210_firmware:12.5.0-02800:*:*:*:*:*:*:*12.5.0-02800VulnerableSonicWall
cpe:2.3:h:sonicwall:sma7210:-:*:*:*:*:*:*:*not specified by NVDRunning onSonicWall
cpe:2.3:a:sonicwall:sma8200v:12.4.3-03245:*:*:*:*:*:*:*12.4.3-03245VulnerableSonicWall
cpe:2.3:a:sonicwall:sma8200v:12.4.3-03387:*:*:*:*:*:*:*12.4.3-03387VulnerableSonicWall
cpe:2.3:a:sonicwall:sma8200v:12.4.3-03434:*:*:*:*:*:*:*12.4.3-03434VulnerableSonicWall
cpe:2.3:a:sonicwall:sma8200v:12.5.0-02283:*:*:*:*:*:*:*12.5.0-02283VulnerableSonicWall
cpe:2.3:a:sonicwall:sma8200v:12.5.0-02624:*:*:*:*:*:*:*12.5.0-02624VulnerableSonicWall
cpe:2.3:a:sonicwall:sma8200v:12.5.0-02800:*:*:*:*:*:*:*12.5.0-02800VulnerableSonicWall
cpe:2.3:a:sonicwall:sma8200v:-:*:*:*:*:*:*:*not specified by NVDRunning onSonicWall
  • cpe:2.3:o:sonicwall:sma7210_firmware:12.5.0-02283:*:*:*:*:*:*:* Versions 12.5.0-02283 Vulnerable ·SonicWall
  • cpe:2.3:o:sonicwall:sma7210_firmware:12.5.0-02624:*:*:*:*:*:*:* Versions 12.5.0-02624 Vulnerable ·SonicWall
  • cpe:2.3:o:sonicwall:sma7210_firmware:12.5.0-02800:*:*:*:*:*:*:* Versions 12.5.0-02800 Vulnerable ·SonicWall
  • cpe:2.3:h:sonicwall:sma7210:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SonicWall
  • cpe:2.3:a:sonicwall:sma8200v:12.4.3-03245:*:*:*:*:*:*:* Versions 12.4.3-03245 Vulnerable ·SonicWall
  • cpe:2.3:a:sonicwall:sma8200v:12.4.3-03387:*:*:*:*:*:*:* Versions 12.4.3-03387 Vulnerable ·SonicWall
  • cpe:2.3:a:sonicwall:sma8200v:12.4.3-03434:*:*:*:*:*:*:* Versions 12.4.3-03434 Vulnerable ·SonicWall
  • cpe:2.3:a:sonicwall:sma8200v:12.5.0-02283:*:*:*:*:*:*:* Versions 12.5.0-02283 Vulnerable ·SonicWall
  • cpe:2.3:a:sonicwall:sma8200v:12.5.0-02624:*:*:*:*:*:*:* Versions 12.5.0-02624 Vulnerable ·SonicWall
  • cpe:2.3:a:sonicwall:sma8200v:12.5.0-02800:*:*:*:*:*:*:* Versions 12.5.0-02800 Vulnerable ·SonicWall
  • cpe:2.3:a:sonicwall:sma8200v:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SonicWall

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    SonicWall SMA1000 — psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008

    2 records Highest priority Priority CRITICAL 2 CRITICAL

    Other records, highest priority first

    • TI-2026-12966 Code injection in SonicWall SMA1000Priority CRITICAL 91
    Show all 2 records → Advisory →

Timeline

  1. 2026-07-14 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2026-15409
  3. 2026-10-03 Alias added: GHSA-35rc-2vcv-r6q5

References

Advisory 1

  • TI-2026-57684 Server-side request forgery in SonicWall SMA1000 KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-16819 Deserialization of untrusted data in SonicWall SMA1000 KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-57685 OS command injection in SonicWall SMA1000 KEVCVSS 3.1HIGH 7.8
  • TI-2026-12966 Code injection in SonicWall SMA1000 KEVCVSS 3.1HIGH 7.2
  • TI-2025-27082 Missing authorization in SonicWall SMA1000 KEVCVSS 3.1MEDIUM 6.6
  • TI-2026-03562 SQL injection in SonicWall SMA1000 CVSS 3.1HIGH 7.2
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences