ctrlINT What the industry said about every indicator, with the quote

CVE-2026-15409Vulnerability

SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .

Reported by 6 independent sources · first reported by Volexity · last reported

Last reported yesterday

CISA KEVAdded 14 Jul 2026
Fix due 17 Jul 2026
Used by ransomware: knownCISA KEV catalogue
EPSS6.8%
higher than 93% of CVEsFIRST EPSS, as of 23 Oct 2026

What the reports say

8 reports, newest first · the exact sentence from each

  1. “CVE-2026-15409 (SonicWall SMA 1000 SSRF) (Staged for targeting, no confirmed compromise)”

    The Hacker NewsNews
    Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions

  2. “In June 2026, two other flaws in the same product (CVE-2026-15409, CVSS score: 10.0, and CVE-2026-15410, CVSS score: 7.2) were weaponized as zero-days by a threat actor dubbed UTA0533 to deploy Java web shells and a malware called KNUCKLEBALL.”

    The Hacker NewsNews
    Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch

  3. “SonicWall disclosed CVE-2026-15409 and CVE-2026-15410 on July 14, and CVE-2026-83548 and CVE-2026-83549 on September 1.”

    The Hacker NewsNews
    SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances

  4. “In 2026, two pre-authentication server-side request forgery flaws (CVE-2026-15409, CVE-2026-83548) in SonicWall’s SMA 1000 appliances have been leveraged as zero-days.”

    Help Net SecurityNews
    SonicWall fixes pre-auth SSRF flaw in SMA 1000 appliances (CVE-2026-102255)

  5. “On July 14, SonicWall reported that threat actors were actively exploiting two SonicWall SMA1000 vulnerabilities as zero-days (CVE-2026-15409 and CVE-2026-15410).”

    CERT-EUGovernment
    Cyber Brief 26-08 - July 2026

  6. “The threat actor acquired initial access through a SonicWall SMA appliance, by exploiting the vulnerability chain disclosed as CVE-2026-15409 and CVE-2026-15410.”

    Sophos X-OpsVendor
    Fake AI, real malware: Attackers impersonating AI brands

  7. “CVE-2026-15409”

    Recorded FutureVendor
    July 2026 CVE Landscape

  8. “CVE-2026-15409 (SSRF)”

    VolexityVendor
    Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation

Indicators reported together

named in the same reports
Copy this indicator · defanged

Also named with it: CVE-2026-15410, CVE-2026-102255, CVE-2024-42009, CVE-2026-25089, CVE-2026-39808, CVE-2026-63030, CVE-2026-83548, CVE-2026-102256, CVE-2026-102257, CVE-2026-102258, CVE-2025-49113, CVE-2026-33824, CVE-2025-5777, CVE-2026-48294, CVE-2026-42897, CVE-2026-35616, CVE-2025-55182, CVE-2018-0802, CVE-2026-50522

Thanks — we review every report.

Report a wrong value
What is wrong with CVE-2026-15409 here?
No account needed. We do not store your IP address.