# CVE-2026-15497: SonicCloudOrg sonic-agent code injection in JWT Authentication Filter

Source: https://junglewise.ai/threats/cve-2026-15497-soniccloudorg-sonic-agent-code-injection-in-jwt-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-12. Updated: 2026-07-12  
License: CC BY 4.0 with a link back

CVE-2026-15497 · Severity: high · CVSS 7.3 · Published 2026-07-12

SonicCloudOrg sonic-agent, a component of the Sonic Cloud Platform used for mobile device testing and management, contains a security flaw in its authentication handling. An unauthenticated remote attacker can bypass security filters to inject and execute malicious code on the server. This could lead to a complete system takeover, unauthorized access to testing data, or disruption of the cloud testing infrastructure. The vendor has not released a patch, and the product is reportedly no longer supported.

Technologies: [SonicCloudOrg Sonic-Agent](https://junglewise.ai/threats/technologies/sonic-agent). Vendors: [SonicCloudOrg](https://junglewise.ai/threats/vendors/soniccloudorg).

## Quick answers

**Is CVE-2026-15497 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15497 being exploited in the wild.

**How severe is CVE-2026-15497?** High severity, with a CVSS score of 7.3, published 12 July 2026.

**Which products and versions are affected?** SonicCloudOrg Sonic-Agent up to 2.7.2.

**Is there a fix for CVE-2026-15497?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15497 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15497?** Check whether you run SonicCloudOrg Sonic-Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A code injection vulnerability exists in SonicCloudOrg sonic-agent versions up to and including 2.7.2. The flaw is located within the JWT Authentication Filter, specifically affecting the ExchangeController.java component in the sonic-server-controller module. The root cause is identified as a failure to properly authenticate critical functions (CWE-306) and improper neutralization of input (CWE-94), allowing an unauthenticated remote attacker to trigger code execution via the /exchange/send endpoint. A public exploit (PoC) has been disclosed. As the vendor has not responded and the product is considered unsupported, no official patch is expected.

## Affected products

- SonicCloudOrg sonic-agent up to 2.7.2

## Timeline

- 2026-07-12: advisory: NVD publication date
- 2026-07-12: disclosed: Public exploit disclosed on GitHub

## References

- [https://github.com/xpp3901/CVE_APPLY/blob/main/V-S001_SonicCloudPlatform_Unauth_ExchangeSend](https://github.com/xpp3901/CVE_APPLY/blob/main/V-S001_SonicCloudPlatform_Unauth_ExchangeSend)
- [https://vuldb.com/cve/CVE-2026-15497](https://vuldb.com/cve/CVE-2026-15497)
- [https://vuldb.com/submit/844486](https://vuldb.com/submit/844486)
- [https://vuldb.com/vuln/377804](https://vuldb.com/vuln/377804)
- [https://vuldb.com/vuln/377804/cti](https://vuldb.com/vuln/377804/cti)

## Related threats

- [SonicCloudOrg sonic-agent OS command injection in Groovy Script Handler](https://junglewise.ai/threats/cve-2026-15496-soniccloudorg-sonic-agent-os-command-injection-in-groovy-script)
- [SonicCloudOrg sonic-agent OS command injection in Android WebSocket Server](https://junglewise.ai/threats/cve-2026-15495-soniccloudorg-sonic-agent-os-command-injection-in-android)