Exploitation active confirmée

Ajoutée au catalogue CISA KEV le 14/07/2026, correctif exigé avant le 17/07/2026 pour les agences fédérales américaines.

Action requise : Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Description officielle (NVD)

SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.

Preuves de concept publiques (6)

Dépôts tiers non vérifiés, parfois piégés. Ne les exécutez jamais en production : uniquement dans un environnement de test isolé.

remmons-r7/rapid7-CVE-2026-15409 · ★ 28 · 15/07/2026
This repo contains a proof-of-concept exploit for CVE-2026-15409. It establishes non-root remote code execution on SonicWall SMA 1000 by implementing the Erlang protocol expected by localhost:1050 and
tc4dy/CVE-2026-15409-15410-Framework · ★ 6 · 17/07/2026
CVE-2026-15409/15410 SonicWall SMA1000 multi-exploit Framework - SSRF→Erlang RPC→RCE→root privesc. Features: --detect safe check, --exec, --read-file, --privesc, --rpc, interactive shell, batch thread
0xBlackash/CVE-2026-15409 · ★ 3 · 15/07/2026
CVE-2026-15409
Ch4120N/CVE-2026-15409 · ★ 3 · 03/08/2026
Proof-of-Concept exploit for CVE-2026-15409 (SonicWall SMA 1000 RCE) via Erlang distribution over WebSocket. Achieves unauthenticated remote code execution as couchdb user.
HORKimhab/CVE-2026-15409 · ★ 0 · 15/07/2026
CVE-2026-15409 - Dectect
MrRawBit/SonicWall-SMA1000-Zero-Day-IoC-Check · ★ 0 · 16/07/2026
Unofficial Bash IoC checker for SonicWall SMA1000 appliances affected by actively exploited CVE-2026-15409 and CVE-2026-15410.