CVE-2026-15409

🚨 CVE-2026-15409 Critical Unauthenticated SSRF in SonicWall SMA1000 Series Critical Server-Side Request Forgery SSRF vulnerability affecting SonicWall SMA1000 Series appliances. This repository documents the vulnerability, affected products, technical overview, impact, detection guidance, and...

CVE-2026-15409-15410-Framework

1 CVE-2026-15409 | 2 CVE-2026-15410 SonicWall SMA1000 - SSRF → Erlang RCE → Root Privesc Exploit Framework & Safe Detection Tool ! Ethical Use Only - Authorized Tests This repository provides tools for authorized security professionals, blue teams, and penetration testers only. Unauthorized acces...

CVE-2026-83548-SonicWall-SMA1000-Analysis

CVE-2026-83548 — SonicWall SMA1000 Vulnerability Analysis A cybersecurity project exploring a real-world vulnerability,its potential impact,and how security teams can detect,fix,and verify the issue. Project Overview This project is part of my cybersecurity learning journey. I selected...

SonicWall SMA1000 SRF Unauthorized Access

The vulnerability of the Appliance WorkPlace microprogramming-based network interface of SonicWall SMA1000 relates to the possibility of bypassing access control mechanisms. Exploiting this vulnerability allows a malicious actor to execute an SRF attack and gain unauthorized access to protected...

vulnerabilities found in the SonicWall SMA1000 appliance

SonicWall has identified several vulnerabilities in the SonicWall SMA1000 appliance. These vulnerabilities include a pre-authentication Server-Side Request Forgery SSRF vulnerability, which allows unauthorized attackers to execute unauthorized internal requests. Additionally, there is a...

SonicWall SMA1000 Series Appliances Affected By Multiple Vulnerabilities

1 CVE-2026-102255 - Pre-authentication SSRF via unintended forward-proxy A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this...

PT-2026-107230

Name of the Vulnerable Software and Affected Versions SonicWall SMA1000 versions prior to 12.4.3-03670 SonicWall SMA1000 versions prior to 12.5.0-03082 Description A pre-authentication server-side request forgery SSRF issue exists in the SMA1000 Appliance Work Place interface. This is caused by a...

SonicWall SMA1000 WorkPlace SSRF (CVE-2026-83548)

Exploits CVE-2026-83548 in SonicWall SMA1000 WorkPlace: unauthenticated absolute-form OPTIONS requests are forwarded to loopback CouchDB, enabling internal database access and downstream RCE chains. !/usr/bin/env python3 -- coding: utf-8 -- """SonicWall SMA1000 WorkPlace SSRF to CouchDB...

...[ More ]

This Metasploit module chains three issues in SonicWall SMA1000 appliances. An unauthenticated, absolute-form OPTIONS request makes the WorkPlace listener act as an unintended forward proxy CVE-2026-83548. The module uses this access and a vendor-installed CouchDB update handler to obtain read an...

Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild

Overview On September 1, 2026, SonicWall disclosed two vulnerabilities affecting SonicWall SMA1000 appliances that the vendor says are being actively exploited in the wild. The vulnerabilities, CVE-2026-83548 and CVE-2026-83549, can be chained to achieve unauthenticated remote code execution RCE ...

Zero-day vulnerabilities are exploited in SonicWall’s SMA1000 appliance.

SonicWall has identified vulnerabilities in the SMA1000 Appliance. The SMA1000 Appliance contains two vulnerabilities. The first is a pre-authentication Server-Side Request Forgery SSRF vulnerability in the Work Place interface, which allows an unauthorized external attacker to perform unauthoriz...

SonicWall SMA1000 Appliances OS Command Injection Vulnerability

SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution...

SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations...

SonicWall SMA1000 Series Appliances Affected By Multiple Vulnerabilities

1 CVE-2026-83548 - Pre-authentication SSRF via unintended forward-proxy A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain...

SonicWall SMA1000 WorkPlace SSRF to Root Remote Code Execution

This module chains three issues in SonicWall SMA1000 appliances. An unauthenticated, absolute-form OPTIONS request makes the WorkPlace listener act as an unintended forward proxy CVE-2026-83548. The module uses this access and a vendor-installed CouchDB update handler to obtain read and write...

Exploit for Server-Side Request Forgery in Sonicwall Sma6210_Firmware

...

SonicWall SMA1000 Series SSRF Detection Tool

A safe detection tool for identifying CVE-2026-15409 affecting SonicWall SMA1000 Series appliances. The Python utility performs non-destructive checks by issuing requests to common application endpoints using an external test URL and reports indicators of possible server-side request forgery...

Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days being Actively Exploited (CVE-2026-15409, CVE-2026-15410)

Overview On July 14, 2026, SonicWall published a security advisory addressing two vulnerabilities affecting SMA1000 Series remote access appliances, including the critical server-side request forgery SSRF vulnerability CVE-2026-15409 CVSS 10.0 and the high-severity code injection vulnerability...

Zero-day vulnerabilities are exploited in SonicWall SMA1000 devices.

SonicWall has identified two vulnerabilities in the SonicWall SMA1000 appliance. The vulnerability with the identifier CVE-2026-15409 involves Server-Side Request Forgery SSRF in the Work Place interface, allowing an unauthorized attacker to send requests to the device to unintended locations. Th...

SonicWall SMA1000 Series Appliances Affected By Multiple Vulnerabilities

1 CVE-2026-15409 - A Server-side request forgery SSRF A Server-side request forgery SSRF vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location. CVSS Score: 10...