Am I vulnerable?
CVE-2026-15409 is an unauthenticated server-side request forgery in the Work Place portal of SonicWall SMA1000 series appliances. It carries a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-07-14, the same day the vendor published, with a three-day remediation deadline of 2026-07-17.
Affected versions
SonicWall enumerates specific builds rather than open ranges. The affected SKUs are SMA 6210, SMA 7210, SMA 8200v and Central Management Server.
| Firmware line |
Vulnerable builds |
Fixed build |
| 12.4.3 |
12.4.3-03245, 12.4.3-03387, 12.4.3-03434 |
12.4.3-03453 and higher |
| 12.5.0 |
12.5.0-02283, 12.5.0-02624, 12.5.0-02800 |
12.5.0-02835 and higher |
Diagnostic checks
- Firmware build (authoritative): log into the Appliance Management Console. The build appears at the bottom left of every AMC page, on the Dashboard under System Information, and at the top of the Maintenance tab. The Hotfixes link on Maintenance or Dashboard lists what is installed. Anything below 12.4.3-03453 or 12.5.0-02835 on its respective line is vulnerable. There is no documented unauthenticated version endpoint, so AMC is the only reliable version source.
- Internet exposure:
curl -4 -I -s -o /dev/null -w '%{http_code}\n' https://<your-sma1000-host>/. Any response confirms the Work Place portal is reachable from that vantage point. This proves exposure, not vulnerability. Exposure plus an affected build is the risk condition.
- Exploitation in the access log:
grep -i 'wsproxy' extraweb_access.log | grep -E ' 101 ' | grep -Ei 'localhost|127\.0\.0\.1|::ffff:127\.0\.0\.1'. An HTTP 101 upgrade on /wsproxy with a loopback target means a tunnel was established, not merely attempted.
- Attacker-planted routes:
grep -E '__api__/(login|logout)' /var/lib/unit/conf.json. These routes do not exist in a legitimate deployment. Any match indicates the appliance was modified.
- Chained privilege escalation:
grep -E 'remove_hotfix|\.\./\.\./' ctrl-service.log. Traversal sequences in a hotfix argument indicate CVE-2026-15410 exploitation, which typically triggers an immediate reboot. Correlate with unexplained restarts.
Patching alone does not answer whether you were already hit. SonicWall's guidance treats forensic review as a required step, not an optional one.
Vulnerability
The flaw is CWE-918, server-side request forgery, in a websocket proxy feature the Work Place portal exposes at /wsproxy on TCP 443. Per Rapid7's analysis, the endpoint behaves like a netcat-style TCP tunnel: the caller supplies a destination host and port as URL parameters and the appliance opens the connection on their behalf. It requires a hardcoded cookie value but no authentication, which is why the CVSS vector shows PR:N and why the scope-change flag pushes the score to a full 10.0.
What makes this severe is not the SSRF primitive in isolation. It is where the appliance sits. Services bound to the SMA1000's loopback interface are implicitly trusted because they were never meant to be reachable from outside, so they are less hardened than the internet-facing surface. Rapid7 observed attackers tunneling to localhost to reach exactly those services, notably an Erlang process on port 1050 and the control service on port 8188.
From there the intrusion chains. Attackers staged a script through a weakly authenticated internal component, then abused CVE-2026-15410, a path traversal in the remove_hotfix workflow of ctrl-service, to execute it as root. The SSRF supplies reach; the traversal supplies code execution. Rapid7 documented root-level persistence via a Python injector loading a Java proxy and a custom webshell into a legitimate SonicWall process.
One correction worth stating plainly: reporting that a public proof of concept exists on GitHub is not corroborated. Both Tenable and Beazley Security Labs stated no PoC was publicly disclosed at the time they published. Treat this as zero-day exploitation by capable operators, not commodity scanning, and expect the risk profile to change if a PoC does surface.
Threat model
Who would exploit this: Volexity attributes the confirmed exploitation to UTA0533, which used both flaws as zero-days from at least 2026-06-22 and deployed appliance-specific custom malware while deliberately staying quiet. Volexity asserts no nation-state nexus. The second category is the criminal ecosystem that reliably follows SonicWall remote-access disclosures, including initial-access brokers and ransomware affiliates. Full device takeover requires chaining and appliance-specific knowledge, which favors deliberate operators over mass scanning, at least until a PoC circulates.
What they are after:
- Stealthy foothold at the perimeter, below the visibility of endpoint tooling
- Credential and authentication material: stored credentials, active session databases, TOTP MFA seeds
- Persistence through implants that run inside legitimate appliance processes
- Lateral movement into Active Directory using the harvested material
- Data exfiltration from internal systems reached after the pivot
Attack chain: An attacker reaches the unauthenticated websocket proxy directly from the internet. The SSRF does not execute code; it grants a tunnel into loopback-bound services the appliance treats as trusted. Attackers staged content through one of those services, then used the remove_hotfix traversal to run it as root. Root access supported a durable webshell and proxy implant inside a legitimate process.
Blast radius: A compromised SMA1000 hands over a trusted perimeter position rather than a single host. Root exposes session databases and TOTP seeds, which lets an attacker authenticate as legitimate users and defeat the MFA the VPN was deployed to enforce. Because the appliance authenticates against enterprise directory services, operators captured LDAP traffic and read credentials in the clear. Rapid7 tracked follow-on NTLM logons (Event ID 4624, logon type 3) from the appliance's internal IP to domain controllers, using workstation names such as kali with no matching VPN session. On cloud-hosted 8200v deployments, the SSRF also reaches instance metadata endpoints.
Named operators: UTA0533 (per Volexity).
Mitigation
Patch
There are no workarounds. SonicWall states that upgrading is the only remediation.
| Firmware line |
Upgrade to |
| 12.4.3 |
12.4.3-03453 or higher |
| 12.5.0 |
12.5.0-02835 or higher |
Hotfix builds are available through mysonicwall.com. Note the vendor caveat on backups: only restore a configuration backup that pre-dates installation of an affected hotfix build.
Post-patch forensic requirements
SonicWall's advisory treats these as mandatory, and CISA's KEV entry invokes its Forensics Triage Requirements under BOD 26-04:
- Upgrade to the fixed build.
- Conduct forensic analysis for the indicators listed above.
- If indicators are present, re-image the hardware appliance or re-deploy the virtual one. Patching a compromised appliance does not evict a root-level implant.
- Change all user and administrator passwords.
- Reset TOTP tokens. Seed material was harvested in observed intrusions, so unrotated seeds remain valid for the attacker.
Compensating controls
- Restrict Work Place interface access to trusted networks where the deployment model allows it (Beazley Security Labs).
- Disable external access to the Management Console.
- Baseline and alert on the appliance's outbound connections. A healthy SMA1000 talks to configured backend resources, AD/LDAP, RADIUS, DNS, NTP and SonicWall licensing, and little else.
- Reconcile every appliance-sourced authentication event against the live VPN session table. Auth traffic from the appliance with no corresponding session is the clearest post-exploitation signal available to most defenders.
Detection (starter rules, validate before deploying)
These rules are AI-generated starter content. Test against your own telemetry and tune falsepositives before deploying to production.
Network and log signals
- Requests to
/wsproxy carrying host=127.0.0.1, host=localhost, host=0.0.0.0, host=::1 or host=::ffff:127.0.0.1, especially with serviceType=SSH or serviceType=TELNET, or targeting ports 1050 and 8188.
- HTTP 101 responses on
/wsproxy in extraweb_access.log where the query string points at loopback or link-local. A 101 means the tunnel was established, so this is success rather than an attempt.
- Appliance requests to cloud metadata endpoints: 169.254.169.254,
fd00:ec2::254, metadata.google.internal. High severity on virtual 8200v deployments.
- Outbound connections from the appliance to RFC1918 space it has no reason to initiate, or on ports it never previously used (22, 23, 445, 3389, 1050, 8188).
- Request bursts to
/wsproxy from one source with varying host and port values. Rank sources by distinct host+port combinations per hour, since internal port sweeping shows up as breadth, not volume.
- HTTP 200 on
/__api__/login or /__api__/logout with no preceding interactive Work Place authentication.
- Any access to
/tmp/temp.db*, which held the active session database, cached credentials and TOTP seeds in observed intrusions. Normal access there should be near zero.
- DNS resolutions from the appliance for SSRF canary and collaborator infrastructure. Deploy your own canary token as a positive control.
- Windows Event ID 4624 logon type 3 from the appliance's internal IP with atypical workstation names and no matching VPN session.
YARA
rule SonicWall_SMA1000_CVE_2026_15409_wsproxy_SSRF_LogArtifact
{
meta:
description = "AI-generated STARTER rule. Flags SonicWall SMA1000 web proxy access-log lines consistent with CVE-2026-15409 /wsproxy SSRF exploitation, where the websocket proxy target is coerced to loopback, link-local or cloud-metadata addresses. Validate in your environment before deploying."
author = "CVE Brief - AI-generated starter rule"
date = "2026-07-20"
cve = "CVE-2026-15409"
reference = "https://www.rapid7.com/blog/post/etr-rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410/"
scope = "Offline forensic triage of exported appliance log bundles, primarily /var/log/aventail/extraweb_access.log*. This rule is NOT a memory or binary scanner and will not match a running exploit."
confidence = "medium"
strings:
// The vulnerable Work Place websocket proxy endpoint
$path = "wsproxy" ascii nocase
// SSRF target coerced back at the appliance itself, or at cloud metadata
$tgt_lo1 = "host=127.0.0.1" ascii nocase
$tgt_lo2 = "host=localhost" ascii nocase
$tgt_lo3 = "host=0.0.0.0" ascii nocase
$tgt_lo4 = "host=::1" ascii nocase
$tgt_lo5 = "host=::ffff:127.0.0.1" ascii nocase
$tgt_lo6 = "host=%3A%3A1" ascii nocase
$tgt_lo7 = "host=%3A%3Affff%3A127.0.0.1" ascii nocase
$tgt_md1 = "host=169.254.169.254" ascii nocase
$tgt_md2 = "host=metadata.google.internal" ascii nocase
// Internal services reached through the proxy in observed intrusions
$svc1 = "serviceType=SSH" ascii nocase
$svc2 = "serviceType=TELNET" ascii nocase
$svc3 = "port=1050" ascii nocase
$svc4 = "port=8188" ascii nocase
// HTTP 101 Switching Protocols: the tunnel was actually established
$ws101 = " 101 " ascii
condition:
filesize < 512MB
and $path
and any of ($tgt_lo*, $tgt_md*)
and (any of ($svc*) or $ws101)
}
Sigma
title: SonicWall SMA1000 Work Place wsproxy SSRF Exploitation (CVE-2026-15409)
id: 3f9c7a41-6b2e-4d58-9a0c-8e15d2b7c463
status: experimental
description: |
AI-generated starter rule. Detects requests to the SonicWall SMA1000 Work Place
/wsproxy websocket proxy endpoint where the proxy destination is coerced to a
loopback, link-local, cloud-metadata or otherwise internal address. This is the
behaviour underlying CVE-2026-15409, an unauthenticated CVSS 10.0 SSRF in the
internet-facing Work Place portal (443/tcp), exploited in the wild since at least
2026-06-22 and chained with CVE-2026-15410. Successful exploitation is indicated
by an HTTP 101 Switching Protocols response. Validate in your environment before
deploying.
references:
- https://www.rapid7.com/blog/post/etr-rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410/
- https://www.tenable.com/blog/cve-2026-15409-cve-2026-15410-sonicwall-sma-1000-zero-day-vulnerabilities-exploited-in-the
- https://nvd.nist.gov/vuln/detail/CVE-2026-15409
author: CVE Brief - AI-generated starter rule
date: 2026-07-20
tags:
- attack.initial-access
- attack.t1190
- attack.discovery
- attack.t1046
- attack.credential-access
- cve.2026.15409
logsource:
category: webserver
product: sonicwall_sma1000
definition: |
SMA1000 web proxy access log (extraweb_access.log, stored under /var/log/aventail/
and exported via AMC > Monitoring > Logging > Syslog), or any upstream reverse proxy,
load balancer or WAF in front of the Work Place portal that records the full request
URI including query string. The query string MUST be logged: many default access-log
formats truncate it, which would silently disable this rule.
detection:
selection_endpoint:
cs-uri-stem|contains: '/wsproxy'
selection_ssrf_target:
cs-uri-query|contains:
- 'host=127.'
- 'host=localhost'
- 'host=0.0.0.0'
- 'host=::1'
- 'host=::ffff:127.0.0.1'
- 'host=%3A%3A1'
- 'host=169.254.169.254'
- 'host=metadata.google.internal'
- 'host=10.'
- 'host=192.168.'
- 'host=172.16.'
condition: selection_endpoint and selection_ssrf_target
fields:
- src_ip
- c-uri
- cs-uri-query
- sc-status
- c-useragent
falsepositives:
- Administrator or vendor-support troubleshooting of the websocket proxy against
localhost from a known internal jump host. Correlate src_ip against your admin
ranges and any open SonicWall support case before escalating.
- Internal vulnerability scanners and authorised penetration tests. Maintain an
allowlist of scanner source IPs.
- Environments that legitimately publish an internal Work Place resource on an
RFC1918 address reachable through the proxy. In that case remove the broad
'host=10.', 'host=192.168.' and 'host=172.16.' entries and keep only the
loopback and metadata patterns, which have no legitimate use.
- Health-check or synthetic-monitoring tooling probing the appliance loopback.
level: critical
Rule notes
Both rules key on the sourced exploitation primitive, a /wsproxy request whose host parameter points at loopback, link-local or metadata space, rather than on unverifiable file hashes. Two limitations matter. The Sigma rule is blind unless your access-log format preserves the full query string and the appliance forwards extraweb_access.log via AMC syslog, and it will miss encoded or DNS-rebinding targets that only resolve to internal addresses at request time, so pair it with the egress and canary signals above. The YARA rule is for offline triage of exported log bundles only, since there is no reliable file-based implant artifact for the SSRF itself, and it cannot distinguish an attempt from a success unless the HTTP 101 status is present in the line.
References