CISA KEV Active Exploitation SSRF Chain

Encoded URLs turn SonicWall SMA1000 into an unauthenticated root shell

July 15, 2026·8 min read·Chris Boker, Founder, CVEasy AI
A SonicWall SMA1000 appliance split into a teal Workplace panel and a gold AMC panel, with an encoded URL entering Workplace from the internet and a rust loop that arcs back inside the chassis to hit AMC on loopback, popping the AMC's padlock and emitting a rust root shell prompt on the far right

Every enterprise treats its secure remote access appliance like the front door of the network. It is the box that terminates VPN tunnels, applies MFA, enforces posture checks, and hands the surviving traffic to the internal network. You trust it because you built the perimeter around it. On July 14, 2026, SonicWall confirmed that a set of those appliances have been trusting themselves in a way that turns the front door inside out.

CVE-2026-15409 is a CVSS 10.0 server-side request forgery in the SMA1000 Workplace interface. CVE-2026-15410 is a CVSS 7.2 post-authentication code injection in the same appliance's management console. Neither is dangerous by itself in the way the numbers first suggest. Chained, they give an unauthenticated attacker on the internet a root shell on the appliance that fronts your internal network. SonicWall has confirmed active exploitation and CISA added both to its Known Exploited Vulnerabilities catalog the same day, with Binding Operational Directive 26-04 giving federal agencies until July 17, 2026 to patch or take the boxes offline.

Where the appliance disagrees with itself about who is on the other end

The SMA1000 runs two web surfaces on one appliance. Workplace is what remote employees hit when they connect from the internet: it accepts session traffic, does authentication, and proxies through to internal resources. Its sibling, the Appliance Management Console or AMC, is what an administrator uses to change routing, provision users, tune posture policies, and upload signed system components. AMC is never supposed to be reachable from the internet, so most deployments listen for it on a dedicated management interface or on loopback, and the appliance's own network stack treats requests to AMC differently depending on which interface they landed on.

That difference is the entire security story. The Workplace surface treats every request as untrusted. The AMC surface treats a request as trusted enough to skip several checks if it looks like it came from the appliance itself. That is a common pattern on network appliances, and it is not wrong in isolation. It becomes wrong the moment anything on the appliance can be convinced to send a request to the AMC on the attacker's behalf. That thing is Workplace.

The encoded URL that slips past the input filter

The Workplace interface accepts a URL parameter as part of its normal operation. In 2025, Bishop Fox's Ronan Kervella showed that improper URL handling let an attacker use an encoded URL to make Workplace fetch content from an unintended location, filed as CVE-2025-40595 with a CVSS of 7.2. SonicWall patched the specific bypass and kept moving.

The 2026 return, credited by SonicWall's advisory to Adam Babis of its own PSIRT team, is the same class of bug that reaches further. The Workplace URL validator still rejects the obvious cases, and it still normalizes some encodings before comparison, but the normalization is incomplete. A URL that has been encoded a second time, or that mixes case in the scheme, or that hides a target inside a fragment in a way the validator does not resolve before it hands the string to the outbound HTTP client, gets through. Once through, the Workplace fetcher rewrites and dispatches the request without applying the validator a second time. The request goes wherever the encoded URL actually pointed. Including, and this is the important part, to the appliance's own loopback address on the AMC's port.

The single sentence version: Encoded URLs slip past the Workplace input filter, the Workplace fetcher then hits the appliance's own loopback AMC endpoint, and the AMC treats a loopback request as an authenticated admin. Attacker gets a root shell without ever seeing a login page.

Why the loopback trust boundary collapses in one hop

Any request the AMC sees arriving from loopback carries an implicit trust that a request from the Workplace socket does not. That trust is what CVE-2026-15410 turns into command execution. The AMC exposes an administrative endpoint that accepts a parameter it treats as an internal control string. Under normal use it is only ever hit by an already-authenticated admin session running on the management interface, so the input path was written with those users in mind. The value ends up interpolated into a shell context. An admin who wanted to break the appliance could always do it here; the vulnerability is that admin authentication on this endpoint is enforced by a session cookie that the AMC issues to sessions arriving over the trusted interface, and the trusted-interface check is a network origin check, not a cryptographic one.

The Workplace SSRF is what makes the network origin check meaningless. Once tunneled through Workplace to loopback, the attacker's request arrives at the AMC's port from an address the AMC has always trusted, so AMC accepts it, the injected value reaches the shell, and the appliance runs the attacker's command as the AMC service account. On SMA1000 that account is root. The full chain fits inside a handful of HTTP requests, with no credentials, no user interaction, and no prior session on the appliance.

Early reporting was already characterizing the pair as unauthenticated root RCE the moment the advisory hit.

The number is right; the queue built from it is not

CVSS lands this at 10.0 because SonicWall scored the chained impact rather than each CVE in isolation, which puts SMA1000 owners in the right ballpark on urgency. What the number cannot tell you is which of your appliances is one hop from a domain controller, which is fronting a lab, and which is decommissioned but still online because a firewall rule from 2023 kept it reachable. A CVSS-first triage queue treats those three identically, so a scanner that flags the CVE says "critical, patch now" against every one, and if you own three hundred SMA appliances across seventy business units, the queue reads as one long wall of tenths. The mis-rank has nothing to do with CVSS being too high; the problem is that priority has to happen against inventory to be useful, and CVSS was never a function of inventory.

How TRIS scores this per appliance, not per CVE

TRIS, the Threat and Risk Intelligence Scoring engine inside CVEasy AI, scores each finding on the exposure that actually decides your week. On CVE-2026-15409 chained with CVE-2026-15410, four layers do the work.

Exploitation status. SonicWall confirmed active exploitation before publishing the advisory and CISA added both CVEs to KEV on July 14. That is enough evidence to move exploitation weight to its top band. A proven attacker chain in the wild is not the same as a public proof-of-concept exploit, and TRIS keeps those distinct: confirmed abuse against real customers weighs more than a PoC on a research blog.

Reachability of the Workplace interface. An SMA1000 whose Workplace port is answering the public internet lands in TRIS's top exposure band, ACT. If Workplace only accepts connections from a private network, a partner VPN, or an allowlisted set of client subnets, the score drops to ATTEND. A powered-on appliance with Workplace disabled entirely drops further still. The CVE is the same, but the exposure is not.

Blast radius by role. A production SMA1000 whose backend routes reach a domain controller, a database tier, or a CI/CD control plane is a different asset than one that fronts a jump host in a segmented lab. TRIS reads asset roles and adjacencies from your inventory and moves the score accordingly.

Mechanism weight for chained flaws. On its own, CVE-2026-15410 is post-auth and deserves ATTEND at most on a production appliance. CVE-2026-15409 alone is unauthenticated but only gives an outbound HTTP request. The chain is what deserves ACT, and TRIS treats it as its own finding rather than averaging the two CVSS scores.

The output is not one queue entry that says "critical, patch now." It is a per-appliance decision with the reason attached.

Patch is not the whole answer if Workplace was internet-exposed. Because the advisory confirms active exploitation before public disclosure, you should assume the attacker reached loopback: rotate every credential and secret the appliance held, and audit the AMC action log for administrative operations you did not perform.

The July 17 patch, and what else has to move with it

Apply the hotfix. Help Net Security lists the fixed builds as 12.4.3-03453 for the 12.4 line and 12.5.0-02835 for the 12.5 line, both platform-hotfix releases, and every later build on either line. Vulnerable inputs called out in the same reporting include 12.4.3-03245, 12.4.3-03387, 12.4.3-03434, 12.5.0-02283, 12.5.0-02624, and 12.5.0-02800. Affected hardware is the SMA6210, SMA7210, and SMA8200v. If you cannot patch by July 17, BOD 26-04 requires FCEB agencies to take the product offline, and that is a reasonable posture for anyone else running an SMA appliance on the public internet during the disclosure window.

For hunt, look in the AMC action log for administrative operations that do not tie back to a real admin session: user provisioning, package installs, and any change to routing or DNS during the disclosure window. On the network side, watch for outbound connections from the appliance to unusual destinations, since the same SSRF that hits loopback can be pointed at cloud metadata endpoints or attacker-controlled hosts to smuggle secrets out. Any secret the appliance held, whether AD service accounts, RADIUS shared secrets, TLS private keys, or certificates the appliance used to authenticate to backend services, should be treated as exposed and rotated.

How CVEasy AI puts each SMA1000 in a specific band

CVEasy AI, the number one local-first CTEM platform, ingests the SonicWall PSIRT advisory and the CISA KEV listing from the sources themselves. For each SMA1000 in your inventory, TRIS resolves the chained CVE-2026-15409 and CVE-2026-15410 against real exposure: whether the Workplace port answers the internet, which backend networks the appliance is authorized to reach, and which credentialed accounts live on it. The output is a specific queue entry per appliance with a reason attached: ACT for the two SMA7210s in the DMZ, ATTEND for the SMA6210 behind the partner VPN, and MONITOR for the SMA8200v you thought you decommissioned last quarter. Every step runs on your hardware, and your inventory and appliance configuration never leave the box.

Sources: BleepingComputer, The Hacker News, Help Net Security, CISA KEV alert, SecurityAffairs, Security Online, NVD CVE-2026-15409, NVD CVE-2026-15410, NVD CVE-2025-40595.