CVE-2026-15410
SonicWall SMA1000 Appliances Code Injection Vulnerability
Description
CVE-2026-15410 is a high-severity code injection vulnerability in the Appliance Management Console (AMC) of SonicWall SMA1000 appliances that allows a remote, authenticated administrator to execute arbitrary OS commands on the device. The flaw stems from improper control of code generation (CWE-94), where externally influenced input can alter the code the management console executes. Although exploitation requires administrator privileges, a successful attack gives full control over the secure access gateway, compromising confidentiality, integrity, and availability. CISA has added CVE-2026-15410 to its Known Exploited Vulnerabilities (KEV) catalog, confirming that this SonicWall SMA1000 vulnerability is being actively exploited in the wild, with a remediation due date of July 17, 2026.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sonicwall | sma6210 firmware | 12.4.3-03245; 12.4.3-03387; 12.4.3-03434; 12.5.0-02283; 12.5.0-02624; 12.5.0-02800 |
| sonicwall | sma7210 firmware | 12.4.3-03245; 12.4.3-03387; 12.4.3-03434; 12.5.0-02283; 12.5.0-02624; 12.5.0-02800 |
| sonicwall | sma8200v | 12.4.3-03245; 12.4.3-03387; 12.4.3-03434; 12.5.0-02283; 12.5.0-02624; 12.5.0-02800 |
References
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15410(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
Code injection occurs when software constructs all or part of a code segment using externally influenced input without properly neutralizing special elements that can modify the syntax or behavior of the intended code. In the SMA1000 Appliance Management Console, this weakness allows an authenticated administrator to inject input that is ultimately interpreted as code, resulting in arbitrary OS command execution on the appliance.
Learn more: CWE-94 — Improper Control of Generation of Code ('Code Injection')
Impact Analysis
CVE-2026-15410 carries a CVSS 3.1 score of 7.2 (High) and is remotely exploitable over the network without physical access, with low attack complexity and no user interaction required. The key limiting factor is that the attacker must already hold high privileges — an administrator account on the AMC — which is why the score is not critical despite the severe outcome. Once exploited, the impact is complete: Confidentiality (High): an attacker can read any data handled by the appliance, including access policies and session information; Integrity (High): device configuration and traffic handling can be manipulated at will; Availability (High): the secure access gateway can be disabled or destabilized, cutting off remote access for the entire organization. Because SMA1000 appliances sit at the network edge and broker remote access, a compromised unit is a high-value pivot point, and the KEV listing confirms attackers are actively targeting this vulnerability — for example after obtaining admin credentials through phishing or credential reuse.
Exploit Maturity
CISA has added CVE-2026-15410 to the Known Exploited Vulnerabilities catalog, which confirms active exploitation of SonicWall SMA1000 appliances in the wild; ransomware usage is currently listed as unknown. No public exploit code is referenced in the available sources — the listed references are the SonicWall vendor advisory and the CISA KEV entry. The EPSS score of about 1.5% (71st percentile) suggests broad mass exploitation is not yet predicted, but the KEV listing outweighs this signal: edge devices with confirmed in-the-wild exploitation should be treated as urgent, and organizations should patch before the July 17, 2026 due date.
Remediation
- Follow CISA's KEV required action: apply mitigations in accordance with SonicWall's vendor instructions (advisory SNWLID-2026-0008), ensure compliance with BOD 26-04 patching guidance and CISA's Forensics Triage Requirements, and discontinue use of the product if mitigations are unavailable — the KEV due date is July 17, 2026.
- Update affected SMA1000-series devices (SMA 6210, SMA 7210, and SMA 8200v running firmware 12.4.3-03245 through 12.4.3-03434 and 12.5.0-02283 through 12.5.0-02800) to a fixed firmware release per the SonicWall PSIRT advisory.
- Restrict access to the Appliance Management Console as an interim mitigation: bind the AMC to a dedicated management network or VPN, never expose it to the internet, and limit access via firewall rules to a small set of administrator source IPs.
- Enforce strong authentication for administrator accounts (MFA, unique credentials) since exploitation requires admin access, and review all AMC admin accounts for unauthorized or stale entries.
- Monitor appliance logs for unexpected administrative actions, configuration changes, or unusual processes, and perform forensic triage on any device that was exposed with vulnerable firmware, treating it as potentially compromised.
Technical Details
The vulnerability is a post-authentication code injection (CWE-94) in the SMA1000 Appliance Management Console: input controlled by an authenticated administrator flows into the generation of a code segment without adequate neutralization of special elements, so under specific conditions the injected content changes the behavior of the executed code and yields arbitrary OS command execution on the underlying system. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable attack of low complexity that needs no user interaction but does require high privileges; the scope remains unchanged because the code executes within the security authority of the appliance itself. Unlike classic OS command injection, the root cause here targets the code-generation layer of the management application, which then results in OS-level command execution with the privileges of the AMC. All three impact metrics are rated High, reflecting that code execution on a security gateway compromises every function the device provides.
Frequently Asked Questions
Is CVE-2026-15410 being actively exploited?
Yes. CISA has added CVE-2026-15410 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild against SonicWall SMA1000 appliances. Ransomware use is currently unknown, and the EPSS score of about 1.5% indicates exploitation is targeted rather than widespread mass scanning.
What products are affected by CVE-2026-15410?
The vulnerability affects the SonicWall SMA1000 series, specifically SMA 6210 firmware, SMA 7210 firmware, and the SMA 8200v virtual appliance. Vulnerable firmware versions include 12.4.3-03245, 12.4.3-03387, 12.4.3-03434, 12.5.0-02283, 12.5.0-02624, and 12.5.0-02800.
How do I fix CVE-2026-15410?
Apply the firmware updates and mitigations published in SonicWall advisory SNWLID-2026-0008, in line with CISA's BOD 26-04 guidance and the KEV due date of July 17, 2026. As interim measures, restrict Appliance Management Console access to a dedicated management network and enforce strong administrator authentication.
How severe is CVE-2026-15410?
CVE-2026-15410 is rated High with a CVSS 3.1 score of 7.2. It allows full compromise of the appliance (high confidentiality, integrity, and availability impact), but exploitation requires an authenticated administrator account, which limits the score. Its EPSS score sits in roughly the 71st percentile of all scored vulnerabilities, and the confirmed KEV listing makes prompt remediation essential.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.