Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
SonicWall SMA1000 Appliances
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N C H H H 10.0 .7422 99.4 YES
AFFECTED
Product Versions Fixed
SMA1000 12.4.3-03245 – —
TIMELINE
Jul 10 Reserved by sonicwall
Jul 14 Added to CISA KEV, remediation due 2026-07-17
Jul 14 Published (CNA: sonicwall)
Jul 18 DUE DATE PASSED — CVE-2026-15409 (SonicWall SMA1000). CISA remediation deadline was July 17, 2026; still in catalog.
Description
A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.
Lifecycle
Complete event history — 4 events, chronological
| Date | Event | Detail |
|---|
| July 10, 2026 | Reserved | Reserved by sonicwall |
| July 14, 2026 | KEV ADDED | Added to CISA KEV, remediation due 2026-07-17 |
| July 14, 2026 | Published | Published (CNA: sonicwall) |
| July 18, 2026 | DUE DATE PASSED | DUE DATE PASSED — CVE-2026-15409 (SonicWall SMA1000). CISA remediation deadline was July 17, 2026; still in catalog. |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| SonicWall | SMA1000 | — | 12.4.3-03245 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-15409 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.