Loading vulnerability…
CVE-2026-15410 is a post-authentication code injection vulnerability affecting the Appliance Management Console (AMC) of SonicWall SMA1000 series appliances. The issue is described as improper control of generation of code and can, under specific conditions, allow a remote authenticated attacker with administrator privileges to execute arbitrary operating system commands on the appliance. Multiple reports also describe the flaw as being usable in an exploit chain with CVE-2026-15409, where the first vulnerability provides access to otherwise restricted internal functionality and CVE-2026-15410 is then used to achieve privileged command execution and full appliance compromise. Public reporting contains some conflicting technical characterizations of the vulnerable component and workflow, but the consistent vendor-aligned description is post-authentication code injection in AMC leading to arbitrary OS command execution.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
4 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Repository contains two Python programs: a full exploit (exploit.py) and a safer detection utility (checker.py), plus README, LICENSE, and requirements.txt. The exploit targets SonicWall SMA1000 appliances and chains CVE-2026-15409 and CVE-2026-15410. Based on the README and visible code, exploit.py implements a manual WebSocket/SSL/socket-based workflow to abuse the exposed wsproxy functionality, tunnel to internal Erlang distribution services, authenticate using a hardcoded Erlang cookie, and invoke Erlang RPC leading to OS command execution via os:cmd/1. It also supports optional privilege escalation by dropping a script into /var/tmp and triggering AMC remove_hotfix path traversal to execute it as root. Additional capabilities described and partially visible include single-target mode, batch mode from file, optional SSRF detection, file reading, interactive shell behavior, custom headers/origin/WebSocket URL overrides, retries/delays, and optional insecure TLS handling. checker.py is a separate detection script, not an exploit, that probes multiple candidate paths and parameters for SSRF using requests and a benign external canary URL (https://httpbin.org/ip). It supports single-target and threaded list scanning. Notable fingerprintable targets include wsproxy-related paths (/workplace/wsproxy, /ui/wsproxy, /portal/wsproxy, /cgi-bin/wsproxy), IOC paths (/__api__/login, /__api__/logout), internal localhost Erlang ports 1050 and 8188, and filesystem paths tied to the privilege-escalation chain. Overall, this is a real, operational exploit repository with both offensive exploitation and safer verification tooling.
Repository contains two Python utilities: a full exploit (exploit.py, ~37 KB) and a safer detection script (checker.py, ~9 KB), plus README, LICENSE, and requirements.txt. The code is not part of a major exploitation framework; it is a standalone Python exploit toolkit targeting SonicWall SMA1000 appliances. The main exploit chains CVE-2026-15409 and CVE-2026-15410. Based on the README and visible code, exploit.py implements manual WebSocket/network handling and Erlang External Term Format helpers to authenticate to an internal Erlang node using a hardcoded/default cookie, then invoke os:cmd/1 for remote command execution. It also supports file reading, interactive shell behavior, batch targeting with threads, optional SSRF detection, and a privilege-escalation stage that writes a script to /var/tmp and triggers AMC hotfix removal with a traversal path to execute as root. checker.py is a separate detection-only scanner. It probes multiple candidate paths and parameters over HTTPS, using https://httpbin.org/ip as a benign SSRF canary. It supports single-target and list-based scanning, multithreading, custom port/path, and reports likely SSRF when reflected external-IP content is observed. Notable fingerprintable targets and artifacts include wsproxy-related paths (/workplace/wsproxy, /ui/wsproxy, /portal/wsproxy, /cgi-bin/wsproxy), IOC paths such as /__api__/login and /__api__/logout, internal SSRF target 127.0.0.1:1050 (and mention of 8188), and filesystem paths /var/tmp/ and /var/lib/unit/conf.json. The exploit appears operational and weaponized rather than a simple PoC because it includes customizable targeting, batch execution, interactive functionality, and a full RCE-to-root chain.
Repository contains a single Python proof-of-concept exploit plus a README. The main file, cve-2026-15409.py, implements enough of the Erlang distribution protocol to authenticate to an internal Erlang node using a hardcoded/default cookie and then issue RPC calls. It supports two transport modes: direct TCP socket access to a host/port and, more importantly for the target scenario, tunneling through the SonicWall SMA 1000 WorkPlace websocket proxy using a wsproxy URL. The WebSocketTransport class wraps the websocket connection, handles the SMA-specific ready frame, and base64-encodes outbound binary protocol data. The script exposes CLI options for websocket URL/origin/user-agent/TLS handling and for selecting one of three actions: erlang:node/0 for validation, file:read_file/1 for arbitrary file read, or os:cmd/1 for arbitrary command execution. The exploit therefore provides non-root RCE in the Erlang node context (documented as couchdb) and arbitrary file read. README indicates the intended target is SonicWall SMA 1000 WorkPlace service, usually on port 443, with exploitation tunneled to localhost:1050; alternate ports such as 8188 are also mentioned. The repository is a real exploit, not a detector, and is operational because it includes working payload functionality rather than mere vulnerability checks.
This repository is a very small single-script Python proof-of-concept for CVE-2026-15410, described in the code as a conceptual SonicWall SMA1000 AMC command-injection issue. Repository structure is minimal: a Python exploit script, README, license, and .gitignore. There is no framework integration, no auxiliary modules, and no dependency manifest despite the README mentioning one. The main script, cve-2026-15410.py, defines a SonicWallSMAExploit class with two core stages: authentication and command-injection testing. First, it builds a requests session, disables TLS verification warnings, optionally configures an HTTP proxy, and sets browser-like headers. The login() method iterates through several guessed login paths (/amc/login, /api/login, /login, /amc/api/auth/login), submitting administrator credentials and treating a 200/302 response with cookies or the word 'session' as a successful login. After authentication, inject_command() iterates through a list of guessed AMC/diagnostic endpoints and tries multiple shell metacharacter separators (;, &&, |, backticks, $(), newline encodings). It places payloads into several common parameter names (ip, host, target, command) and sends GET requests in an attempt to trigger command execution. The script prints the first part of the HTTP response when it sees a 200 status and labels that as a possible success. Important limitations indicate this is a conceptual PoC rather than a validated exploit: the script explicitly states the real vulnerable endpoint and parameter are not public, relies on guessed endpoints and parameter names, and uses simplistic success criteria. It does not establish a shell, drop a secondary payload, or implement persistence. Its main capability is attempting authenticated remote command execution with a user-supplied command, making it best classified as a POC exploit rather than a detection-only script or a weaponized tool.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
210 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
One of two SonicWall SMA1000 vulnerabilities linked by CISA to ransomware activity; the pair includes a maximum-severity server-side request forgery flaw.
A SonicWall SMA1000 vulnerability mentioned only in related-content text as being exploited in ransomware attacks.
An improper code-generation/code injection vulnerability in the SonicWall SMA1000 Appliance Management Console that can allow arbitrary OS command execution by an authenticated administrator and can be chained with CVE-2026-15409 for root-level compromise.
A recently patched SonicWall SMA1000 vulnerability that has been actively exploited in zero-day attacks and is now flagged by CISA as exploited by ransomware gangs.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.