A Server-side request forgery

CVE-2026-15409 is an unauthenticated SSRF in the Work Place interface of the SonicWall SMA1000 series (SMA6210, SMA7210, SMA8200v) — the exact web-facing portal that remote employees hit to log into your VPN. The bug lets a remote attacker with no credentials coerce the appliance into issuing HTTP(S) requests to internal targets, including management planes, cloud metadata endpoints (169.254.169.254 on the virtual 8200v), and neighboring services that were never meant to be reachable from the DMZ. Affected firmware: 12.4.3 branches prior to 12.4.3-03453 and 12.5.0 branches prior to 12.5.0-02835.

The vendor's 10.0/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H rating is honest, not inflated. SonicWall has confirmed in-the-wild exploitation, and threat actors are chaining this SSRF with CVE-2026-15410 (code injection) to convert the pivot into pre-auth RCE on the appliance. This is a canonical high-value-role bug: the flaw lives in a network edge device by design, so the friction discount you'd normally apply to an SSRF (internal-only impact) evaporates.

Why this verdict

• Active exploitation: SonicWall PSIRT itself confirms in-the-wild use, chained with CVE-2026-15410 — this is not a theoretical CVSS 10, it is a live campaign.
• Role multiplier: The affected component is a network edge SSL-VPN appliance — ~100% of installs occupy the high-value role by definition. Chain outcome is RCE on the trust boundary, session harvesting, and pivot into the corporate LAN. Floor is CRITICAL.
• Zero friction on the entry step: Unauthenticated, network-reachable, no user interaction. The Work Place portal is *designed* to be internet-exposed; you cannot 'not expose' it and still have a VPN.
• Chain-ready: The companion CVE-2026-15410 is patched in the same hotfix — attackers already have both halves, defenders must apply both together.
• No compensating control fully substitutes for the patch because the vulnerable endpoint is the login portal itself.

Why not higher?

10.0 is already the CVSS ceiling; noisgate reports 9.8 only because the current absence of a public one-click PoC and a still-scoped physical-appliance blast radius (no IMDS on hardware units) marginally slow mass automated exploitation compared to worm-class bugs like log4shell.

Why not lower?

A downgrade would require evidence that the Work Place interface is not internet-exposed at ≥99% of deployments — which is impossible for an SSL-VPN portal — or that exploitation requires authentication, which SonicWall explicitly denies. Neither condition holds.

1. Apply the SonicWall hotfix now — Upgrade to 12.4.3-03453 or 12.5.0-02835 — this closes both CVE-2026-15409 and CVE-2026-15410. Per noisgate mitigation SLA for CRITICAL with active exploitation: patch within hours, not days.
2. Restrict Work Place portal access by source geography/IP where feasible — If your VPN user base is regional, apply a geofence at your upstream WAF or edge firewall to shrink the attack surface. Not a substitute for the patch; a stopgap for the <24h window before you can ship it.
3. Rotate all SMA1000 admin credentials, session secrets, and SAML signing keys post-patch — Because pre-auth RCE is in play, assume any exposed appliance is potentially compromised. Rotate within 3 days of patching per noisgate mitigation SLA.
4. Enforce IMDSv2 with hop-limit=1 on any SMA8200v virtual deployments — Blocks the cloud metadata pivot from step 3 regardless of the SSRF. Apply within 3 days; permanent hardening.
5. Hunt for IoCs from SonicWall KB SNWLID-2026-0019 — Run SonicWall's integrity check tooling and grep httpd logs for double-encoded scheme patterns (%2568%2574%2574%2570, http%3A%2F%2F127) dating back 30 days. Complete within 3 days.

Run on an auditor workstation with network reach to each SMA1000 appliance's management or Work Place interface. Invoke as ./check_sma1000.sh sma.example.com — needs only outbound TCP/443 and curl + jq. No credentials required; the script reads the version banner exposed by the portal.

#!/usr/bin/env bash
# noisgate: CVE-2026-15409 / CVE-2026-15410 checker for SonicWall SMA1000
# Usage: ./check_sma1000.sh <host-or-ip>
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN
set -u
HOST="${1:-}"
if [ -z "$HOST" ]; then
  echo "UNKNOWN: usage $0 <host>" >&2; exit 2
fi

# Fixed versions per SonicWall PSIRT SNWLID-2026-0019
FIX_124="12.4.3-03453"
FIX_125="12.5.0-02835"

# The Work Place login page leaks the firmware string in an HTML comment / meta tag
BODY=$(curl -sk --max-time 10 "https://${HOST}/__api__/v1/logon/init" 2>/dev/null)
if [ -z "$BODY" ]; then
  BODY=$(curl -sk --max-time 10 "https://${HOST}/cgi-bin/welcome" 2>/dev/null)
fi

VER=$(printf '%s' "$BODY" | grep -oE '1[0-9]\.[0-9]+\.[0-9]+-[0-9]+' | head -n1)
if [ -z "$VER" ]; then
  echo "UNKNOWN: could not fingerprint SMA1000 firmware on ${HOST}"; exit 2
fi

MAJOR_MINOR=$(echo "$VER" | cut -d. -f1-2)
case "$MAJOR_MINOR" in
  12.4)
    FIX="$FIX_124";;
  12.5)
    FIX="$FIX_125";;
  *)
    echo "UNKNOWN: unrecognized branch ${MAJOR_MINOR} on ${HOST}"; exit 2;;
esac

# Version compare
if [ "$(printf '%s\n%s\n' "$VER" "$FIX" | sort -V | head -n1)" = "$FIX" ] && [ "$VER" != "$FIX" ] || [ "$VER" = "$FIX" ]; then
  echo "PATCHED: ${HOST} runs ${VER} (>= ${FIX})"; exit 0
else
  echo "VULNERABLE: ${HOST} runs ${VER} (< ${FIX}) — CVE-2026-15409 / -15410"; exit 1
fi

Sources

1. Help Net Security — SonicWall SMA zero-day attacks
2. SonicWall PSIRT advisory index
3. SonicWall product notice — Encoded URL SSRF (SMA1000 parent class)
4. Cybersecurity Dive — SonicWall warns of critical SMA1000 exploitation
5. CISA Known Exploited Vulnerabilities Catalog
6. CSA Singapore alert AL-2026-033 — Multiple SMA1000 vulns
7. Cybersecurity News — SMA1000 encoded-URL exploit detail
8. SecurityOnline — CVE-2025-40595 stealth SSRF background