CVE-2026-15410: 
SonicWall SMA 8200v Appliance Analyse et atténuation des vulnérabilités

CVE-2026-15410 is a post-authentication code injection vulnerability (CWE-94) in the SonicWall SMA1000 Appliance Management Console (AMC) that allows a remote authenticated attacker with administrator privileges to execute arbitrary OS commands under specific conditions. It affects SMA1000 firmware versions 12.4.3-03245 through 12.4.3-03434 and 12.5.0-02283 through 12.5.0-02800. The vulnerability was published on July 14, 2026, and was immediately added to the CISA Known Exploited Vulnerabilities (KEV) catalog the same day with a remediation due date of July 17, 2026. It carries a CVSS v3.1 base score of 7.2 (High) (SonicWall PSIRT, CISA KEV).

The vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection) and resides in the SMA1000 Appliance Management Console (AMC). An authenticated attacker with administrator-level access can inject malicious code through the AMC interface that is subsequently executed as OS commands on the underlying system under specific conditions. Because exploitation requires prior administrative authentication, the attack complexity is low but the privilege requirement is high, limiting the attack surface to compromised or malicious admin accounts. No detailed public technical write-up or PoC exploit code with confirmed working functionality has been identified at this time (SonicWall PSIRT, CISA KEV).

Successful exploitation grants a remote attacker the ability to execute arbitrary OS commands on the SMA1000 appliance, resulting in full compromise of confidentiality, integrity, and availability of the affected device. An attacker could use this access to exfiltrate VPN credentials and session data, pivot into internal network segments protected by the SMA1000, deploy persistent backdoors, or disrupt remote access services for enterprise users. Given the SMA1000's role as a secure remote access gateway, compromise of the appliance poses significant risk of lateral movement into the broader enterprise network (SonicWall PSIRT, BleepingComputer).

1. Credential Acquisition: Obtain valid SMA1000 AMC administrator credentials through phishing, credential stuffing, brute force, or by chaining with CVE-2026-15409 (SSRF) to extract session tokens or credentials from the management interface.
2. Authentication: Log into the SMA1000 Appliance Management Console (AMC) using the acquired administrator credentials over HTTPS.
3. Identify Injection Point: Navigate to the vulnerable AMC functionality that improperly handles user-supplied input used in code generation or command construction — the specific endpoint has not been publicly disclosed.
4. Inject Malicious Payload: Submit a crafted input containing OS command injection syntax (e.g., shell metacharacters or code constructs) into the vulnerable AMC parameter under the specific conditions required to trigger code execution.
5. Achieve OS Command Execution: The injected payload is processed by the AMC without proper sanitization, resulting in arbitrary OS command execution on the SMA1000 appliance with the privileges of the AMC service.
6. Post-Exploitation: Use OS-level access to establish persistence (e.g., SSH backdoor, cron job), exfiltrate VPN credentials or configuration data, or pivot into internal network segments accessible through the SMA1000 (SonicWall PSIRT, BleepingComputer).

• Network: Unusual outbound connections from the SMA1000 appliance to external IP addresses, particularly on non-standard ports; unexpected administrative sessions originating from unfamiliar IP addresses to the AMC interface.
• Logs: AMC access logs showing authenticated administrator sessions from anomalous source IPs or at unusual times; log entries reflecting unexpected configuration changes or command execution events within the AMC audit trail.
• Process: Unexpected child processes spawned by the AMC service process (e.g., shell interpreters such as /bin/sh, /bin/bash, or utilities like curl, wget, nc); unusual cron jobs or scheduled tasks created on the appliance.
• File System: New or modified files in AMC directories, unexpected scripts or binaries placed on the appliance filesystem, or modifications to startup/init configurations.
• Authentication: Multiple failed administrator login attempts followed by a successful login (indicative of credential stuffing); administrator logins from IPs not associated with known management hosts (BleepingComputer, CISA KEV).

SonicWall has issued an urgent security advisory (SNWLID-2026-0008) and organizations should apply the vendor-provided patches immediately. Affected versions are SMA1000 12.4.3-03245 through 12.4.3-03434 and 12.5.0-02283 through 12.5.0-02800; users should upgrade to the fixed firmware versions referenced in the SonicWall advisory. CISA's BOD 26-04 mandates that federal agencies apply mitigations by July 17, 2026, or discontinue use of the product if mitigations are unavailable. As interim workarounds, restrict AMC access to trusted administrator IPs only via firewall rules or ACLs, enforce multi-factor authentication on all administrative accounts, and monitor AMC logs for anomalous activity. Network segmentation to isolate the SMA1000 management interface from general network access is also strongly recommended (SonicWall PSIRT, CISA KEV).

SonicWall issued an urgent advisory urging immediate patching, describing the vulnerabilities as actively exploited zero-days (SonicWall PSIRT). BleepingComputer and The Hacker News both published prominent coverage highlighting the zero-day nature of the attacks and the pairing with CVE-2026-15409, driving significant community attention (BleepingComputer, The Hacker News). SecurityWeek noted the urgency of the patch warning, and Security Affairs covered CISA's addition of the flaws to the KEV catalog. Multiple national CERTs including Canada's CCCS, Singapore's CSA, and Hong Kong's HKCERT issued independent advisories, reflecting broad international concern about the active exploitation (Canadian CCCS, Singapore CSA). Reddit communities including r/cybersecurity and r/sonicwall saw active discussion urging immediate patching of affected appliances.