Is CVE-2026-15497 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15497 being exploited in the wild.

How severe is CVE-2026-15497?

High severity, with a CVSS score of 7.3, published 12 July 2026.

Which products and versions are affected?

SonicCloudOrg Sonic-Agent up to 2.7.2.

Is there a fix for CVE-2026-15497?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15497 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15497?

Check whether you run SonicCloudOrg Sonic-Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15497: SonicCloudOrg sonic-agent code injection in JWT Authentication Filter

CVE-2026-15497 · Severity: high · CVSS 7.3 · Published 2026-07-12

SonicCloudOrg sonic-agent, a component of the Sonic Cloud Platform used for mobile device testing and management, contains a security flaw in its authentication handling. An unauthenticated remote attacker can bypass security filters to inject and execute malicious code on the server. This could lead to a complete system takeover, unauthorized access to testing data, or disruption of the cloud testing infrastructure. The vendor has not released a patch, and the product is reportedly no longer supported.

Technologies: SonicCloudOrg Sonic-Agent. Vendors: SonicCloudOrg.

Quick answers

Is CVE-2026-15497 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15497 being exploited in the wild.
How severe is CVE-2026-15497?: High severity, with a CVSS score of 7.3, published 12 July 2026.
Which products and versions are affected?: SonicCloudOrg Sonic-Agent up to 2.7.2.
Is there a fix for CVE-2026-15497?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15497 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15497?: Check whether you run SonicCloudOrg Sonic-Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A code injection vulnerability exists in SonicCloudOrg sonic-agent versions up to and including 2.7.2. The flaw is located within the JWT Authentication Filter, specifically affecting the ExchangeController.java component in the sonic-server-controller module. The root cause is identified as a failure to properly authenticate critical functions (CWE-306) and improper neutralization of input (CWE-94), allowing an unauthenticated remote attacker to trigger code execution via the /exchange/send endpoint. A public exploit (PoC) has been disclosed. As the vendor has not responded and the product is considered unsupported, no official patch is expected.

Affected products

SonicCloudOrg sonic-agent up to 2.7.2

Timeline

2026-07-12: advisory: NVD publication date
2026-07-12: disclosed: Public exploit disclosed on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.