Is CVE-2026-15410 exploited in the wild?

Yes. CVE-2026-15410 is known to be exploited in the wild, first recorded on 14 July 2026. Treat it as urgent.

How severe is CVE-2026-15410?

Critical severity, published 14 July 2026.

Which products and versions are affected?

SonicWall SMA 1000 Series 12.4.3-03245 through 12.4.3-03434, 12.5.0-02283 through 12.5.0-02800, 12.4.3-03245 to 12.4.3-03434, 12.5.0-02283 to 12.5.0-02800.

Is there a fix for CVE-2026-15410?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15410 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-15410?

Check whether you run SonicWall SMA 1000 Series or SonicWall SMA1000 Appliances at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15410: SonicWall SMA1000 code injection in Appliance Management Console

CVE-2026-15410 · Severity: critical · Exploited in the wild · Published 2026-07-14

A security vulnerability has been identified in the management console of SonicWall SMA1000 series appliances, which are used to provide secure remote access to corporate resources. Under specific conditions, an authorized administrator could bypass security controls to execute unauthorized commands on the underlying operating system. While this requires existing administrative access, it could allow a malicious or compromised administrator to gain full control over the appliance, potentially leading to data theft or network disruption.

Technologies: SonicWall SMA1000 Appliances. Vendors: SonicWall.

Quick answers

Is CVE-2026-15410 exploited in the wild?: Yes. CVE-2026-15410 is known to be exploited in the wild, first recorded on 14 July 2026. Treat it as urgent.
How severe is CVE-2026-15410?: Critical severity, published 14 July 2026.
Which products and versions are affected?: SonicWall SMA 1000 Series 12.4.3-03245 through 12.4.3-03434, 12.5.0-02283 through 12.5.0-02800, 12.4.3-03245 to 12.4.3-03434, 12.5.0-02283 to 12.5.0-02800.
Is there a fix for CVE-2026-15410?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15410 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-15410?: Check whether you run SonicWall SMA 1000 Series or SonicWall SMA1000 Appliances at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A code injection vulnerability (CWE-94) exists in the SonicWall SMA1000 Appliance Management Console (AMC). The flaw stems from improper control of code generation, which can be exploited by a remote authenticated attacker with administrative privileges. By sending specially crafted input under specific conditions, the attacker can achieve arbitrary OS command execution on the underlying Linux-based platform. The vulnerability affects firmware versions 12.4.3-03245 through 12.4.3-03434 and 12.5.0-02283 through 12.5.0-02800. Exploitation requires valid administrative credentials.

Affected products

SonicWall SMA1000 12.4.3-03245 to 12.4.3-03434, 12.5.0-02283 to 12.5.0-02800

Timeline

2026-07-14: disclosed: Initial advisory publication by SonicWall and NVD.

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.