CVE-2026-15410

CVE-2026-15410 is a post-authentication code injection flaw (CWE-94) in the Appliance Management Console (AMC) of SonicWall SMA 1000 series appliances. It is triggered when a remote attacker with valid administrator credentials accesses the AMC under specific conditions, allowing arbitrary OS command execution on the appliance. Successful exploitation yields full command execution with the privileges of the appliance, enabling data theft, credential harvesting, lateral movement, and — per CISA — use in ransomware operations. Organizations running SMA 1000 appliances (SMA 6210, SMA 7210, SMA 8000v) are affected. The flaw is being actively exploited in the wild as a zero-day, reportedly alongside a companion SMA 1000 zero-day (CVE-2026-15409) with which it may form an attack chain; it was added to the CISA KEV catalog on 2026-07-14, and EPSS (11.8%, 96th percentile) indicates elevated near-term exploitation risk.

What to do: Apply the SonicWall SMA 1000 firmware update addressing CVE-2026-15410 (and the related CVE-2026-15409) as soon as the vendor fix is published, following SonicWall's advisory instructions and CISA BOD 26-04 requirements if applicable. Until patched, restrict AMC access to trusted management networks rather than the public internet, verify which administrator accounts have AMC access, and review appliances for signs of compromise given known ransomware use — follow CISA's Forensics Triage Requirements for federal assets.