CVE-2026-15409

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.

Scoring

Severity

CRITICAL

CVSS base score

10

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS probability

83.66%

CISA KEV

Known exploited vulnerability

CWE

CWE-918

Published

2026-07-14

Last modified

2026-08-04

Affected products

• SonicWall SMA1000
• SonicWall SMA1000

Weakness type

• CWE-918

Related vulnerabilities

• CVE-2026-88001 — Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets
• CVE-2026-87999 — Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
• CVE-2026-87996 — Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
• CVE-2026-19233 — CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized...
• CVE-2026-86771 — Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num
• CVE-2026-87821 — Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch
• CVE-2026-79635 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
• CVE-2026-57866 — Apache Impala: Secrets Exfiltration via SSRF

Markdown version · Browse all CVEs