Loading vulnerability…
CVE-2026-15409 is a critical server-side request forgery vulnerability in the SonicWall SMA1000 Appliance Workplace interface. The flaw is remotely exploitable without authentication and allows an external attacker to cause the appliance to initiate requests to unintended destinations. Available reporting further characterizes the issue as a pre-authentication wsproxy bypass that can open a WebSocket tunnel to services intended to be reachable only from localhost, exposing internal appliance functionality to an unauthenticated remote attacker. On affected SMA1000 appliances, this behavior can be used to reach restricted internal services and create a path for follow-on exploitation, including chaining with CVE-2026-15410 for full appliance compromise.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
4 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (4 hidden).
This repository is a small standalone Python exploit PoC for CVE-2026-15409 targeting SonicWall SMA 1000 appliances. The repo contains 5 files: a single main Python exploit script (cve-2026-15409.py), README documentation, requirements.txt listing the websockets dependency, plus license and gitignore. The exploit is not part of a larger framework. The main capability is unauthenticated remote code execution by abusing a WebSocket proxy endpoint that forwards traffic to an internal Erlang distribution service. The script implements the Erlang distribution handshake and Erlang External Term Format encoding/decoding, then authenticates using a cookie value and invokes Erlang RPC calls over the rex service. Its primary offensive action is os:cmd/1 for arbitrary command execution, but it also supports file:read_file/1 for file disclosure and erlang:node/0 for connectivity testing. Operationally, the script accepts a WebSocket URL via --ws-url, optional Origin and User-Agent headers, and an option to disable TLS verification for self-signed certificates. It also exposes direct TCP host/port parameters as a fallback path. User-controlled arguments determine whether the exploit executes a command, reads a file, or performs a simple RPC test. The code includes logging, exception handling, and CLI parsing, making it a usable operational PoC rather than a minimal demo. Fingerprintable target details documented in the repository include the /wsproxy endpoint, typical external port 443, internal Erlang ports 1050 and 8188, the Erlang node couchdb@127.0.0.1, and example file paths such as /etc/passwd and /var/tmp/. Overall, this is a real exploit repository with a functional payload and clear targeting of SonicWall SMA 1000 WorkPlace service instances vulnerable to CVE-2026-15409.
Repository contains two Python programs: a full exploit (exploit.py) and a safer detection utility (checker.py), plus README, LICENSE, and requirements.txt. The exploit targets SonicWall SMA1000 appliances and chains CVE-2026-15409 and CVE-2026-15410. Based on the README and visible code, exploit.py implements a manual WebSocket/SSL/socket-based workflow to abuse the exposed wsproxy functionality, tunnel to internal Erlang distribution services, authenticate using a hardcoded Erlang cookie, and invoke Erlang RPC leading to OS command execution via os:cmd/1. It also supports optional privilege escalation by dropping a script into /var/tmp and triggering AMC remove_hotfix path traversal to execute it as root. Additional capabilities described and partially visible include single-target mode, batch mode from file, optional SSRF detection, file reading, interactive shell behavior, custom headers/origin/WebSocket URL overrides, retries/delays, and optional insecure TLS handling. checker.py is a separate detection script, not an exploit, that probes multiple candidate paths and parameters for SSRF using requests and a benign external canary URL (https://httpbin.org/ip). It supports single-target and threaded list scanning. Notable fingerprintable targets include wsproxy-related paths (/workplace/wsproxy, /ui/wsproxy, /portal/wsproxy, /cgi-bin/wsproxy), IOC paths (/__api__/login, /__api__/logout), internal localhost Erlang ports 1050 and 8188, and filesystem paths tied to the privilege-escalation chain. Overall, this is a real, operational exploit repository with both offensive exploitation and safer verification tooling.
Repository contains two Python utilities: a full exploit (exploit.py, ~37 KB) and a safer detection script (checker.py, ~9 KB), plus README, LICENSE, and requirements.txt. The code is not part of a major exploitation framework; it is a standalone Python exploit toolkit targeting SonicWall SMA1000 appliances. The main exploit chains CVE-2026-15409 and CVE-2026-15410. Based on the README and visible code, exploit.py implements manual WebSocket/network handling and Erlang External Term Format helpers to authenticate to an internal Erlang node using a hardcoded/default cookie, then invoke os:cmd/1 for remote command execution. It also supports file reading, interactive shell behavior, batch targeting with threads, optional SSRF detection, and a privilege-escalation stage that writes a script to /var/tmp and triggers AMC hotfix removal with a traversal path to execute as root. checker.py is a separate detection-only scanner. It probes multiple candidate paths and parameters over HTTPS, using https://httpbin.org/ip as a benign SSRF canary. It supports single-target and list-based scanning, multithreading, custom port/path, and reports likely SSRF when reflected external-IP content is observed. Notable fingerprintable targets and artifacts include wsproxy-related paths (/workplace/wsproxy, /ui/wsproxy, /portal/wsproxy, /cgi-bin/wsproxy), IOC paths such as /__api__/login and /__api__/logout, internal SSRF target 127.0.0.1:1050 (and mention of 8188), and filesystem paths /var/tmp/ and /var/lib/unit/conf.json. The exploit appears operational and weaponized rather than a simple PoC because it includes customizable targeting, batch execution, interactive functionality, and a full RCE-to-root chain.
Repository contains a single Python proof-of-concept exploit plus a README. The main file, cve-2026-15409.py, implements enough of the Erlang distribution protocol to authenticate to an internal Erlang node using a hardcoded/default cookie and then issue RPC calls. It supports two transport modes: direct TCP socket access to a host/port and, more importantly for the target scenario, tunneling through the SonicWall SMA 1000 WorkPlace websocket proxy using a wsproxy URL. The WebSocketTransport class wraps the websocket connection, handles the SMA-specific ready frame, and base64-encodes outbound binary protocol data. The script exposes CLI options for websocket URL/origin/user-agent/TLS handling and for selecting one of three actions: erlang:node/0 for validation, file:read_file/1 for arbitrary file read, or os:cmd/1 for arbitrary command execution. The exploit therefore provides non-root RCE in the Erlang node context (documented as couchdb) and arbitrary file read. README indicates the intended target is SonicWall SMA 1000 WorkPlace service, usually on port 443, with exploitation tunneled to localhost:1050; alternate ports such as 8188 are also mentioned. The repository is a real exploit, not a detector, and is operational because it includes working payload functionality rather than mere vulnerability checks.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
280 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
One of two SonicWall SMA1000 vulnerabilities that CISA linked to ransomware activity; the content does not provide further technical detail specific to this CVE beyond its inclusion in the exploited pair.
A SonicWall SMA1000 vulnerability mentioned only in related-content text as being exploited in ransomware attacks.
A critical SSRF vulnerability in the SonicWall SMA1000 Workplace interface that can be exploited without authentication or user interaction and can be chained to reach internal functionality.
A maximum-severity SonicWall SMA1000 vulnerability, described as an SSRF flaw, that has been actively exploited in zero-day attacks and is now flagged by CISA as exploited by ransomware gangs.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.