Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.
High 7.2Actively exploited
CVE-2026-15410
SonicWall SMA1000 Appliances — Code Injection.
Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a…
WeaknessCWE-94: Code injection
Published Updated Source NVD and CISA KEV
CVSS 3.1
7.2
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploit chance, 30 days
12%
Higher than 96% of all CVEs (EPSS)
Status
Actively exploited
On CISA KEV since 14 Jul 2026
Patch
Unknown
Check the vendor advisory
What happened
What to do
- 01Check whether you run SonicWall SMA1000 Appliances, and which version.
- 02Follow the vendor advisory for a fix or a workaround.
- 03Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA deadlineUS federal agencies must remediate by
References
Timeline · UTC
- Added to CISA KEV
- Published to NVD
- CISA remediation deadline
- NVD record updated
Also actively exploited
Other CVEs in SonicWall SMA1000 Appliances
3 more CVEs, 3 actively exploited