Loading vulnerability…
CVE-2026-15410 is a high-severity vulnerability affecting SonicWall SMA1000 series appliances. It is described as a post-authentication improper control of generation of code vulnerability in the Appliance Management Console (AMC) that can allow arbitrary operating system command execution under specific conditions. Available technical reporting further characterizes the issue as a path traversal flaw in the remove_hotfix helper invoked by the control-service sysCtrl.execRemoveHotfix function. By abusing the hotfix-removal workflow, an attacker can cause attacker-controlled script content or paths to be processed in a way that results in privileged command execution. In observed exploitation, the flaw was used as the second stage of a chain with CVE-2026-15409 to reach internal control functionality and escalate to root on the appliance.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
4 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Repository contains two Python programs: a full exploit (exploit.py) and a safer detection utility (checker.py), plus README, LICENSE, and requirements.txt. The exploit targets SonicWall SMA1000 appliances and chains CVE-2026-15409 and CVE-2026-15410. Based on the README and visible code, exploit.py implements a manual WebSocket/SSL/socket-based workflow to abuse the exposed wsproxy functionality, tunnel to internal Erlang distribution services, authenticate using a hardcoded Erlang cookie, and invoke Erlang RPC leading to OS command execution via os:cmd/1. It also supports optional privilege escalation by dropping a script into /var/tmp and triggering AMC remove_hotfix path traversal to execute it as root. Additional capabilities described and partially visible include single-target mode, batch mode from file, optional SSRF detection, file reading, interactive shell behavior, custom headers/origin/WebSocket URL overrides, retries/delays, and optional insecure TLS handling. checker.py is a separate detection script, not an exploit, that probes multiple candidate paths and parameters for SSRF using requests and a benign external canary URL (https://httpbin.org/ip). It supports single-target and threaded list scanning. Notable fingerprintable targets include wsproxy-related paths (/workplace/wsproxy, /ui/wsproxy, /portal/wsproxy, /cgi-bin/wsproxy), IOC paths (/__api__/login, /__api__/logout), internal localhost Erlang ports 1050 and 8188, and filesystem paths tied to the privilege-escalation chain. Overall, this is a real, operational exploit repository with both offensive exploitation and safer verification tooling.
Repository contains two Python utilities: a full exploit (exploit.py, ~37 KB) and a safer detection script (checker.py, ~9 KB), plus README, LICENSE, and requirements.txt. The code is not part of a major exploitation framework; it is a standalone Python exploit toolkit targeting SonicWall SMA1000 appliances. The main exploit chains CVE-2026-15409 and CVE-2026-15410. Based on the README and visible code, exploit.py implements manual WebSocket/network handling and Erlang External Term Format helpers to authenticate to an internal Erlang node using a hardcoded/default cookie, then invoke os:cmd/1 for remote command execution. It also supports file reading, interactive shell behavior, batch targeting with threads, optional SSRF detection, and a privilege-escalation stage that writes a script to /var/tmp and triggers AMC hotfix removal with a traversal path to execute as root. checker.py is a separate detection-only scanner. It probes multiple candidate paths and parameters over HTTPS, using https://httpbin.org/ip as a benign SSRF canary. It supports single-target and list-based scanning, multithreading, custom port/path, and reports likely SSRF when reflected external-IP content is observed. Notable fingerprintable targets and artifacts include wsproxy-related paths (/workplace/wsproxy, /ui/wsproxy, /portal/wsproxy, /cgi-bin/wsproxy), IOC paths such as /__api__/login and /__api__/logout, internal SSRF target 127.0.0.1:1050 (and mention of 8188), and filesystem paths /var/tmp/ and /var/lib/unit/conf.json. The exploit appears operational and weaponized rather than a simple PoC because it includes customizable targeting, batch execution, interactive functionality, and a full RCE-to-root chain.
Repository contains a single Python proof-of-concept exploit plus a README. The main file, cve-2026-15409.py, implements enough of the Erlang distribution protocol to authenticate to an internal Erlang node using a hardcoded/default cookie and then issue RPC calls. It supports two transport modes: direct TCP socket access to a host/port and, more importantly for the target scenario, tunneling through the SonicWall SMA 1000 WorkPlace websocket proxy using a wsproxy URL. The WebSocketTransport class wraps the websocket connection, handles the SMA-specific ready frame, and base64-encodes outbound binary protocol data. The script exposes CLI options for websocket URL/origin/user-agent/TLS handling and for selecting one of three actions: erlang:node/0 for validation, file:read_file/1 for arbitrary file read, or os:cmd/1 for arbitrary command execution. The exploit therefore provides non-root RCE in the Erlang node context (documented as couchdb) and arbitrary file read. README indicates the intended target is SonicWall SMA 1000 WorkPlace service, usually on port 443, with exploitation tunneled to localhost:1050; alternate ports such as 8188 are also mentioned. The repository is a real exploit, not a detector, and is operational because it includes working payload functionality rather than mere vulnerability checks.
This repository is a very small single-script Python proof-of-concept for CVE-2026-15410, described in the code as a conceptual SonicWall SMA1000 AMC command-injection issue. Repository structure is minimal: a Python exploit script, README, license, and .gitignore. There is no framework integration, no auxiliary modules, and no dependency manifest despite the README mentioning one. The main script, cve-2026-15410.py, defines a SonicWallSMAExploit class with two core stages: authentication and command-injection testing. First, it builds a requests session, disables TLS verification warnings, optionally configures an HTTP proxy, and sets browser-like headers. The login() method iterates through several guessed login paths (/amc/login, /api/login, /login, /amc/api/auth/login), submitting administrator credentials and treating a 200/302 response with cookies or the word 'session' as a successful login. After authentication, inject_command() iterates through a list of guessed AMC/diagnostic endpoints and tries multiple shell metacharacter separators (;, &&, |, backticks, $(), newline encodings). It places payloads into several common parameter names (ip, host, target, command) and sends GET requests in an attempt to trigger command execution. The script prints the first part of the HTTP response when it sees a 200 status and labels that as a possible success. Important limitations indicate this is a conceptual PoC rather than a validated exploit: the script explicitly states the real vulnerable endpoint and parameter are not public, relies on guessed endpoints and parameter names, and uses simplistic success criteria. It does not establish a shell, drop a secondary payload, or implement persistence. Its main capability is attempting authenticated remote command execution with a user-supplied command, making it best classified as a POC exploit rather than a detection-only script or a weaponized tool.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
215 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability in SonicWall SMA appliances that was part of an exploited initial-access chain in a ransomware intrusion discussed in the article.
One of two SonicWall SMA1000 vulnerabilities linked by CISA to ransomware activity; the pair includes a maximum-severity server-side request forgery flaw.
A SonicWall SMA1000 vulnerability mentioned only in related-content text as being exploited in ransomware attacks.
An improper code-generation/code injection vulnerability in the SonicWall SMA1000 Appliance Management Console that can allow arbitrary OS command execution by an authenticated administrator and can be chained with CVE-2026-15409 for root-level compromise.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.