CVE-2026-15409

KEV Critical · CVSS 10.0

SonicWall SMA1000 Appliance Work Place — Server-Side Request Forgery (SSRF)

CVSS: 10.0; nvd
EPSS: 1.40%; 69th pct
KEV: Listed; 2026-07-14
Class: kernel local; CWE-918

Description

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.

Search profile — drives PoC discovery

Symbols WorkPlaceSMA1000SNWLID-2026-0008applianceunauthenticatedremote request forgeryunintended location

Keywords CVE-2026-15409SMA1000SonicWallWorkPlaceSSRFSNWLID-2026-0008Server-Side Request ForgeryunauthenticatedSMA 1000sonicwall ssrf pocSMA1000 workplace ssrf

Versions: <UNKNOWN>

Ranked PoCs (3) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

0xBlackash/CVE-2026-15409 needs review

recent activity

gh_search · Python

★ 0
HORKimhab/CVE-2026-15409 needs review

recent activity

gh_search · Python

★ 0
remmons-r7/rapid7-CVE-2026-15409 needs review

recent activity

gh_search · Python

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-15T18:00:20.000Z · profiled 2026-07-15T18:30:20.000Z