AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

SonicWallCVE-2026-15409

SonicWall SMA1000: server-side request forgery

SonicWall

CVE-2026-15409 · Published Jul 14, 2026 · updated Jul 16, 2026

Critical10.0
No fix yet
SonicWall advisory

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.

Affected versions

PackageAffectedFixed in
SMA1000
Product
>= 12.4.3-03245, <= 12.4.3-03434No fix yet
>= 12.5.0-02283, <= 12.5.0-02800No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity from
CISA (its enrichment of the CVE record)
Weakness
CWE-918

More SonicWall advisories

All SonicWall
High 8.4Aug 11SonicWall GMS: unsafe deserializationCVE-2026-18634no fix yetMedium 6.1Aug 11SonicWall GMS: cross-site scriptingCVE-2026-66146no fix yetCritical 9.1Aug 11SonicWall GMS: remote code executionCVE-2026-66145no fix yetMedium 5.5Aug 7SonicWall Global VPN Client: out-of-bounds readCVE-2026-66151no fix yetMedium 6.5Aug 5SonicWall SonicOS: remote attacker could manipulate the Host headerCVE-2026-0516no fix yetHigh 7.2Jul 14SonicWall SMA1000: code injectionCVE-2026-15410no fix yet