CVE-2026-15410: SonicWall SMA1000 AMC — Code Injection Remote Code Execution

Background

SonicWall SMA1000 is an enterprise remote access appliance that handles VPN connectivity, access policy enforcement, and authentication brokering for external users connecting to internal corporate resources. The Appliance Management Console (AMC) is the administrative web interface used by IT administrators to configure VPN policies, user authentication, access control rules, and network settings. AMC access requires administrator-level credentials and is typically restricted to management network segments.

CVE-2026-15410 is a code injection vulnerability (CWE-94) in the SMA1000 AMC. An authenticated administrator can inject and execute arbitrary code in the context of the appliance’s operating system, achieving full remote code execution on the underlying host. The CVSS 3.1 base score is 7.2 HIGH (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). CISA added this to the Known Exploited Vulnerabilities catalog on July 14, 2026, with a July 17 remediation deadline — the same deadline as companion SSRF vulnerability CVE-2026-15409. Both are covered under SonicWall advisory SNWLID-2026-0008.

Technical Mechanism

CWE-94 (Code Injection) occurs when an application processes user-controlled input in a way that allows it to be interpreted as executable code by an interpreter or runtime facility. In the SMA1000 AMC, a configuration or management function fails to properly sanitize input before passing it to an underlying interpreter or system facility.

The vulnerability differs from direct OS command injection (CWE-78) in that the injection targets an intermediate code interpreter. This may involve template injection, expression language injection, or injection into scripting facilities used for policy configuration or dynamic content generation within the appliance firmware. The consequence is equivalent: the attacker gains the ability to execute arbitrary commands on the appliance’s underlying operating system with the privileges of the AMC process — typically elevated system-level context.

While the high privilege requirement (PR:H) reflects that administrative credentials are needed, this barrier is reduced significantly in the context of a chained attack. CVE-2026-15409 provides a path from unauthenticated internet access to AMC credential acquisition: SSRF through the WorkPlace portal reaches internal services (Active Directory, LDAP, internal credential stores) that may contain or allow derivation of AMC administrative credentials. Once those credentials are obtained, CVE-2026-15410 converts them into OS-level persistence.

Real-World Exploitation Evidence

CISA added both CVE-2026-15409 and CVE-2026-15410 to the KEV catalog simultaneously on July 14, 2026, with the same three-day remediation deadline. Simultaneous listing of two vulnerabilities in the same advisory with identical deadlines is a strong signal that CISA has observed active chained exploitation of both CVEs in combination.

The confirmed chained exploitation pattern:

1. Attacker exploits CVE-2026-15409 (SSRF, unauthenticated) via internet-facing WorkPlace portal
2. SSRF pivots to internal LDAP, Active Directory, or web services to enumerate or extract AMC administrative credentials
3. Attacker uses obtained credentials to authenticate to the AMC
4. CVE-2026-15410 (code injection) achieves OS-level remote code execution on the appliance
5. With appliance-level OS access, attacker plants persistent backdoor and uses the appliance’s internal routing for lateral movement into the enterprise

SonicWall appliances have been a recurring target for sophisticated threat actors including those tracked to nation-state operators conducting initial access campaigns.

Impact Assessment

• OS-level remote code execution on the SMA1000 appliance
• Full control of VPN gateway: policy modification, credential interception, session hijacking for all active VPN users
• Persistent backdoor installation on appliance firmware layer
• Internal network lateral movement via appliance routing — the appliance has routed access to internal network segments by design
• Credential interception for all users authenticating through the compromised appliance
• Disabling or poisoning of access control rules for all connected remote users

Affected Versions

Remediation Steps

1. Apply the firmware update from SNWLID-2026-0008 immediately. This single update addresses both CVE-2026-15409 and CVE-2026-15410. Available through the SonicWall customer portal (MySonicWall account).

2. Restrict AMC access to a dedicated management VLAN with strict firewall rules permitting access only from known administrator workstations — before patching completes if possible:

# On SMA1000: restrict management access to specific source IPs
# AMC > System > Access Control > Management Interface Access
# Specify allowed management source IP ranges

3. Enforce MFA for all AMC administrative accounts. A single compromised credential should not be sufficient to exploit this vulnerability in isolation.

4. Audit all current AMC user accounts and remove any that are not actively required.

5. Rotate all AMC administrative credentials — given active exploitation of CVE-2026-15409 which provides a path to obtaining these credentials, treat any existing AMC passwords as potentially compromised.

6. Isolate the AMC management interface on a separate network segment from the WorkPlace-facing interface to break the SSRF-to-AMC lateral movement path.

7. Review recent AMC configuration changes for unauthorized modifications: new VPN policies, account additions, certificate changes, or routing rule modifications.

Detection Guidance

AMC Audit Logs

The SMA1000 AMC records administrative audit events. Monitor for:

• Configuration changes to fields accepting free-form text input, particularly those involving script content, expressions, or template strings
• Configuration changes occurring outside established maintenance windows or from previously unseen administrator IP addresses
• Multiple rapid sequential configuration changes (consistent with automated exploitation)
• AMC logins from IPs not in the known administrator source range

OS-Level Indicators

If code injection has succeeded, OS-layer indicators include:

• Unexpected processes spawned by the AMC web service process
• New files written to locations only expected to change during firmware updates
• Outbound network connections from the appliance to external IPs from non-standard processes
• Modifications to startup scripts, cron jobs, or service definitions on the appliance

Sigma-format Detection Rule

title: SonicWall SMA1000 AMC Suspicious Configuration Change
description: Detects AMC configuration changes outside normal patterns that may indicate CVE-2026-15410 exploitation
logsource:
  product: sonicwall
  service: sma1000-amc
detection:
  selection:
    event_type: "config_change"
  filter_normal:
    change_source_ip|cidr:
      - "10.0.0.0/8"     # Replace with actual known admin IP ranges
    change_time|re: "^(0[89]|1[0-7]):"   # Business hours filter
  condition: selection and not filter_normal
level: high
tags:
  - CVE-2026-15410
  - T1505.003

Indicators of Compromise

• AMC configuration fields containing script tags, expression language syntax (${}, #{}), backticks, or pipe characters in unexpected contexts
• SMA1000 initiating outbound connections to external IPs from the management interface
• New or modified files in appliance filesystem locations not expected to change outside firmware updates
• AMC administrative logins from IP addresses not in known administrator source ranges

Timeline

References

• NVD — CVE-2026-15410
• CISA KEV Catalog
• SonicWall PSIRT Advisory SNWLID-2026-0008