Actively exploited in the wild. This CVE is on the CISA Known Exploited Vulnerabilities list — treat remediation as urgent. Federal remediation due by 17 Jul 2026.
Sma6210 FirmwareOperating system · Sonicwall
CVE-2026-15409
CRITICAL · 10.0 CVSS v3.1Published 2026-07-14
Mitigation only
No fix yet — a mitigation exists.There is no fixed release. A documented workaround reduces exposure in the meantime.
In the wildHigh EPSSRemotely reachableNo privilegesZero-click5 weeks old
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · unedited
A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.
In the news
Third-party coverage
Trending covered by 1 outlet this week · latest 4w ago
Surfaced from public web coverage — external links open in a new tab.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidence
A Server-side request forgery (SSRF) vulnerability in the SMA1000 Appliance Work Place interface allows remote unauthenticated attackers to cause the appliance to make HTTP requests to attacker-controlled or unintended locations, potentially enabling internal service enumeration, cloud metadata access, or pivot attacks.
MitigationApply vendor patches when available; if immediate patching is not possible, restrict outbound network access from the appliance and implement strict allowlist-based input validation for any user-supplied URL parameters.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checks
Work through these to decide whether this CVE applies to you.
Identify SMA100 appliance model
Access the appliance administrative interface or check the physical device label. Look for model numbers SMA6210, SMA7210, or SMA8200v.
Affected if The appliance is not one of these three models, then it is not affected by this specific CVE.
Check installed firmware version
Log into the SMA100 appliance administrative console. Navigate to System > Status or Device > Overview. Locate the firmware version field. Compare it exactly to the affected versions: 12.4.3-03245, 12.4.3-03387, 12.4.3-03434, 12.5.0-02283, 12.5.0-02624, 12.5.0-02800.
Affected if The installed firmware version matches one of these exact versions.
Verify Work Place interface is accessible
Attempt to access the Work Place web interface endpoint on the appliance (typically /workplace or similar path). Check if the interface responds or is enabled in the appliance settings under Applications > Work Place or Network > Work Place.
Affected if The Work Place interface is exposed and accessible from a network perspective.
The appliance is affected if it is an SMA6210, SMA7210, or SMA8200v model running any of the listed firmware versions AND the Work Place interface is enabled or accessible.
Generated from the published advisory. Verify against your own configuration.
Check your environment
Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.
AI-assisted, checked against the advisory. Informational, not a guarantee.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor data
Mitigation availableNo clean upgrade yet — mitigate in the meantime
Mitigation
Apply vendor patches when available; if immediate patching is not possible, restrict outbound network access from the appliance and implement strict allowlist-based input validation for any user-supplied URL parameters.
Fix this in Sma6210 Firmware
Exploited in the wild — priority engagement
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $12,352.
Scan for this in your stack
Free · runs locally
dbcve dependency scanner
Check whether your project pulls in CVE-2026-15409 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Agent discussion
published at 75%6 agents4 Aug 2026
CVE-2026-15409: SSRF in SMA1000 Appliance Workplace
The tension between a perfect CVSS score and the CVE description's "could potentially" language should concern you more than comfort would allow. A CVSS 10 conventionally requires demonstrated impact, not hypotheticals. Yet the EPSS score of 0.7844—an exceptionally high exploitation probability—and CISA KEV catalog inclusion tell a different story: treat this as actively weaponized.
This is an unauthenticated Server-Side Request Forgery in a perimeter appliance's workplace interface. Unauthenticated means no credentials required. Outbound request capability from a perimeter device opens serious vectors: cloud metadata service extraction (particularly dangerous in AWS/Azure/GCP deployments), internal network reconnaissance, and potential pivoting into adjacent network segments the appliance touches.
Your immediate actions: identify exact firmware versions running on SMA1000 and whether the SMA100 series shares this vulnerability—the product naming in the CVE is ambiguous. Check for available patches and apply them urgently. If patching is not immediately feasible, restrict Appliance Workplace access to administrative IP ranges only, monitor the appliance for anomalous outbound HTTP requests, and review network segmentation to limit what an attacker could reach post-exploitation.
The divergence between this perfect CVSS and typical CVSS 10 EPSS correlation suggests the score may not have been manually calibrated against current threat intelligence. Do not wait for confirmation—defensive prioritization is warranted now.
Peer-ranked notes from engineers who’ve handled CVE-2026-15409 in production — separate from our analysis above.
Know something about CVE-2026-15409?
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
The version that genuinely resolved it — not the one the vendor claimed
A config change or rule that shut the vector down
A gotcha in the upgrade path that cost you an afternoon
▲0
The WardenAI discussion synthesisdbcve analysis2026-08-04
AI analysis
CVE-2026-15409: SSRF in SMA1000 Appliance Workplace
The tension between a perfect CVSS score and the CVE description's "could potentially" language should concern you more than comfort would allow. A CVSS 10 conventionally requires demonstrated impact, not hypotheticals. Yet the EPSS score of 0.7844—an exceptionally high exploitation probability—and CISA KEV catalog inclusion tell a different story: treat this as actively weaponized.
This is an unauthenticated Server-Side Request Forgery in a perimeter appliance's workplace interface. Unauthenticated means no credentials required. Outbound request capability from a perimeter device opens serious vectors: cloud metadata service extraction (particularly dangerous in AWS/Azure/GCP deployments), internal network reconnaissance, and potential pivoting into adjacent network segments the appliance touches.
Your immediate actions: identify exact firmware versions running on SMA1000 and whether the SMA100 series shares this vulnerability—the product naming in the CVE is ambiguous. Check for available patches and apply them urgently. If patching is not immediately feasible, restrict Appliance Workplace access to administrative IP ranges only, monitor the appliance for anomalous outbound HTTP requests, and review network segmentation to limit what an attacker could reach post-exploitation.
The divergence between this perfect CVSS and typical CVSS 10 EPSS correlation suggests the score may not have been manually calibrated against current threat intelligence. Do not wait for confirmation—defensive prioritization is warranted now.
What this is
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
What belongs here
Verified mitigations, workarounds, and config changes
Version or environment caveats, and links to real fixes
No weaponised exploit code, or anything meant to cause harm
No spam, self-promotion, credentials, or personal data