Skip to main content
Meo

Security tracker

CVE-2026-15409: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

In short

SonicWall SMA1000 Appliances has a weakness classified as server-side request forgery (CWE-918). CISA added it to its Known Exploited Vulnerabilities catalog on 2026-07-14. CISA reports known ransomware campaign use.

What it is

“SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.” — CISA KEV, retrieved 2026-11-01
“A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.” — NVD, retrieved 2026-11-01

Who is affected

SonicWall SMA1000 Appliances. NVD lists the following versions as affected:

  • Sonicwall sma6210 Firmware: version 12.4.3-03245
  • Sonicwall sma6210 Firmware: version 12.4.3-03387
  • Sonicwall sma6210 Firmware: version 12.4.3-03434
  • Sonicwall sma6210 Firmware: version 12.5.0-02283
  • Sonicwall sma6210 Firmware: version 12.5.0-02624
  • Sonicwall sma6210 Firmware: version 12.5.0-02800
  • Sonicwall sma7210 Firmware: version 12.4.3-03245
  • Sonicwall sma7210 Firmware: version 12.4.3-03387
  • Sonicwall sma7210 Firmware: version 12.4.3-03434
  • Sonicwall sma7210 Firmware: version 12.5.0-02283
  • Sonicwall sma7210 Firmware: version 12.5.0-02624
  • Sonicwall sma7210 Firmware: version 12.5.0-02800
  • Sonicwall sma8200v: version 12.4.3-03245
  • Sonicwall sma8200v: version 12.4.3-03387
  • Sonicwall sma8200v: version 12.4.3-03434
  • Sonicwall sma8200v: version 12.5.0-02283
  • Sonicwall sma8200v: version 12.5.0-02624
  • Sonicwall sma8200v: version 12.5.0-02800

Exploitation status

CISA KEV added: 2026-07-14. Known ransomware campaign use: Known (reported by CISA). Due date CISA set for US federal civilian agencies: 2026-07-17.

Scores

CVSS: Not listed by NVD.

EPSS by FIRST: 6.79%; percentile 94.00; score date 2026-10-31. EPSS estimates the probability of exploitation in the next 30 days.

CWE: CWE-918.

Timeline

Source events
DateEvent
2026-07-14CISA KEV added
2026-07-14T20:16:56.783NVD published
2026-07-17CISA KEV due
2026-10-24T21:10:00.130NVD last modified
2026-10-31FIRST EPSS score

CISA required action

“Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.” — CISA KEV

What to do

  • Confirm whether you run SonicWall SMA1000 Appliances and which version.
  • Apply the vendor update or mitigation in the advisory.
  • Follow CISA’s required action.
  • Review the vendor guidance on signs of compromise.
  • Track the fix through completion.

References

Sources and dates

CISA Known Exploited Vulnerabilities Catalog, version 2026.10.30; retrieved 2026-11-01. CISA KEV data: CC0 1.0. No endorsement by CISA.

NVD retrieved: 2026-11-01. This product uses the NVD API but is not endorsed or certified by the NVD.

EPSS scores by FIRST; score date 2026-10-31.

Check your own domain's public security settings

The snapshot checks a domain you own or are authorized to check for DNS, HTTPS/TLS and web-header hygiene. It does not test for this CVE.

Check your own domain's public security settingsBook a scoping call