SonicWall SMA1000 Zero-Day SSRF/LPE CVE-2026-15409/15410 Advisory and POC

Vulnerability Overview The Rapid7 MDR team has identified two zero-day vulnerabilities in active use against SonicWall SMA1000 series remote access devices: CVE-2026-15409 and CVE-2026-15410. CVE-2026-15409: This is a critical Server-Side Request Forgery (SSRF) vulnerability with a CVSS score of 10.0. Successful exploitation allows an unauthenticated attacker to open a websocket-based tunnel to any local loopback service. CVE-2026-15410: This is a local privilege escalation vulnerability with a CVSS score of 8.0. It allows an attacker with access to internal services listening on port 8188 to execute arbitrary operating system commands via malicious path traversal. These vulnerabilities are being actively exploited, allowing attackers to gain control of the system by bypassing traditional input validation controls. Affected Scope Affected SonicWall SMA1000 series devices, including models 6210, 7210, and 8200v, running the following versions: 12.4.3-03245 12.4.3-03387 12.4.3-03434 (platform-hotfix) 12.5.0-02283 12.5.0-02624 12.5.0-02800 (platform-hotfix) These vulnerabilities do not affect the SSL VPN functionality of SonicWall firewalls or SMA 100 series products. Remediation Organizations should immediately upgrade to the latest platform hotfix versions: SMA1000 Series (6210, 7210, 8200v): 12.4.3-03453 (platform-hotfix) or later SMA1000 Series (6210, 7210, 8200v): 12.5.0-02835 (platform-hotfix) or later Due to confirmed active exploitation, organizations should not rely solely on patching. SonicWall also recommends: Conducting a thorough forensic review to identify indicators of compromise (IoCs) Re-imaging physical devices or redeploying virtual devices if compromise is confirmed Changing user and administrator passwords Resetting TOTP tokens POC Code The following is proof-of-concept code for CVE-2026-15409: The following is an example malicious request leveraging CVE-2026-15410: The following is an example system monitoring (pspy) output showing behavior during exploitation: Observed Exploitation Attackers are exploiting these vulnerabilities by bypassing traditional input validation controls to gain system control. Once a foothold is established, attackers systematically exfiltrate high-value credentials, active session databases, and time-based one-time password (TOTP) multi-factor authentication (MFA) seed configurations. These activities aim to ensure long-term, persistent threat presence capable of surviving standard network-level remediation efforts. Indicators and Evidence Sources Rapid7 recommends reviewing device logs for evidence of active exploitation, including the following behavioral characteristics and specific log indicators: WebSocket exploit IOC log patterns: entries containing the strings indicate interactions with the niche affected service. Hotfix removal exploit IOC log patterns: The shows the hotfix-removal utility ( ) being invoked with traversal sequences pointing to attacker-staged shell script payloads. Internet-facing probing: Enumeration of the SMA portal, including repeated requests to , path-traversal attempts, and generic file/enumeration requests. Authentication activity: Authentication-API activity against . Sensitive path access: Access to sensitive appliance paths such as , consistent with the theft of stored session data. AD/Service Account Compromise: NTLM logons (Windows Event ID 4624, logon type 3) into internal domain controllers sourced from the appliance's internal IP address. extraweb_access.log: Requests to or returning HTTP 200, and requests to containing suspicious host parameters returning HTTP 101. Configuration Artifacts containing routes for or , which are not present in legitimate configurations. Atomic Indicators F.N.S Holdings Limited (ASN - 206092): The threat actor(s) utilized varying IP addresses, but they belonged to the VPN hosting provider FNS Holdings Limited. Limit or block access to FNS Holdings Limited if there is no business need. For reference, the IP addresses we observed were: - 45.131.194.0/24 - 45.146.54.0/24 - 63.135.161.0/24 - 172.239.211.0/24 - 193.37.32.[1]79 - 193.37.32.[2]14 - 216.73.163.[1]51 - 216.73.163.[1]58 If any indicators of compromise are identified, organizations should treat the device as compromised and follow SonicWall's recovery guidelines. Rapid7 Customers Organizations should prioritize identifying all internet-facing SonicWall SMA1000 devices and determine whether affected software versions have been deployed. Given the confirmed active exploitation by SonicWall and Rapid7, exposed devices should be treated as high-priority assets for remediation. Security teams should also review available authentication, web access, and device management logs to determine if subsequent incident response activities are required. Exposure Command, InsightVM, and Nexpose Exposure Command, InsightVM, and Nexpose customers will be able to assess exposure to CVE-2026-15409 and CVE-2026-15410, with authenticated vulnerability checks

Goal Reached Thanks to every supporter — we hit 100%!

SonicWall SMA1000 Zero-Day SSRF/LPE CVE-2026-15409/15410 Advisory and POC