SonicWall SMA1000 Appliances Vulnerable to Code Injection Attack

## Overview CISA added CVE-2026-15410 to its Known Exploited Vulnerabilities (KEV) list on July 14, 2026. This vulnerability affects SonicWall SMA1000 Appliances. It allows a remote authenticated attacker to execute arbitrary operating system commands. The addition to the KEV list indicates a federal deadline for remediation due to evidence of exploitation. ## Technical Details The vulnerability resides in the SMA1000 Appliance Management Console (AMC). It stems from improper control of code generation after authentication. Attackers with administrative access can exploit this flaw under specific conditions. The CVSS score of 7.2 highlights its severity. Successful exploitation can lead to significant system compromise. ## Impact If exploited, this vulnerability can allow attackers to execute arbitrary commands on the underlying operating system. This could lead to unauthorized access, data breaches, or further attacks within the network. Organizations using affected appliances must take immediate action to protect their systems. ## Mitigation SonicWall has released patches to address this vulnerability. Administrators should apply updates to their SMA1000 Appliances as soon as possible. Regularly review access controls and monitor for unusual activity. Implementing network segmentation can also help limit potential damage from exploitation.