CVE-2026-15410: SonicWall SMA1000 AMC code injection allows OS command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with known ransomware use, a three-day remediation deadline and a high-severity CVSS of 7.2, despite requiring administrator authentication.

What it is

The SMA1000 Appliance Management Console (AMC) contains a post-authentication code injection flaw (CWE-94) that, under specific conditions, lets an authenticated administrator execute arbitrary OS commands. It affects SMA6210, SMA7210 and SMA8200v firmware. Because it yields OS-level command execution on a security appliance, it is a serious post-compromise escalation and persistence vector.

Impact

An attacker who already holds administrator credentials gains arbitrary OS command execution on the appliance, enabling full control of the device, data access and further lateral movement.

Attack surface

Reachable over the network via the AMC interface (AV:N, AC:L, UI:N), but it requires high privileges, meaning valid administrator authentication is needed before the flaw can be triggered.

Exploitation

CVE-2026-15410 was added to CISA KEV on 2026-07-14 with a remediation due date of 2026-07-17 and is flagged for known ransomware campaign use; EPSS gives a 30-day probability of 0.11791 (95.86th percentile). No public exploit references are listed beyond the vendor advisory and the KEV entry.

What to do

• Apply the SonicWall vendor fix per advisory SNWLID-2026-0008 as the first action.
• Follow CISA BOD 26-04 guidance, including the KEV required action and forensics triage requirements.
• Restrict AMC administrative access to trusted management networks and remove internet exposure where possible.
• Rotate administrator credentials and review admin accounts for unauthorized changes.
• If mitigations are unavailable, discontinue use of the affected appliance as CISA advises.

Detection

• Hunt AMC and appliance logs for unexpected OS command execution or child processes spawned by the management console.
• Monitor for anomalous administrator logins and post-login activity on SMA1000 appliances.
• Alert on new or modified files, scheduled tasks or services on the appliance consistent with persistence.
• Review network flows to and from the AMC interface for unusual outbound connections.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.