🔴

CISA Known Exploited Vulnerability

This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.

CVE

CVE-2026-15409

10.0

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

sma1000

Updated Nov 10, 2026View on NVD →

S4E scanner

criticalNetwork Vulnerabilities~10 seconds

SonicWall SMA1000 - Server-Side Request Forgery

SMA1000 Appliance Work Place interface contains a server side request forgery caused by improper request validation, letting remote unauthenticated attackers make requests to unintended locations, exploit requires no special privileges. References: https://www.rapid7.com/blog/post/etr-rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410/ https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409 https://github.com/remmons-r7/rapid7-CVE-2026-15409 Remediation: Update to the latest version.

Used 18 times · 9 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: sma1000

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →