{"schema":"vulnpedia.poc/1","cve":"CVE-2026-15409","generated":"2026-10-26T06:59:15.268Z","kev":{"since":"2026-07-14","ransomware":true},"epss":{"score":0.06795,"percentile":0.93953},"cvss":{"version":"3.1","score":10,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"has_public_poc":true,"poc_sources":[{"kind":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/sonicwall_sma1000_wsproxy_rce.rb","executable":true,"sourceId":"exploit/linux/http/sonicwall_sma1000_wsproxy_rce","description":"SonicWall SMA1000 WorkPlace wsproxy SSRF Remote Command Execution","verification":"catalogued","source":"metasploit","modified":"2026-07-29 15:13:38 +0000","origins":[{"source":"metasploit","sourceId":"exploit/linux/http/sonicwall_sma1000_wsproxy_rce","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/sonicwall_sma1000_wsproxy_rce.rb"},{"source":"metasploit","sourceId":"exploit/linux/http/sonicwall_sma1000_wsproxy_rce","modified":"2026-07-29 15:13:38 +0000","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/sonicwall_sma1000_wsproxy_rce.rb"}]},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/b72cb64708d2","executable":false,"sourceId":"b72cb64708d2","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"b72cb64708d2","modified":"2026-07-14T00:00:00Z","url":"https://vulncheck.com/xdb/b72cb64708d2"}],"repositoryUrl":"https://github.com/remmons-r7/rapid7-CVE-2026-15409"}],"poc_candidates":[{"url":"https://github.com/HORKimhab/CVE-2026-15409","source":"poc-in-github","sourceId":"CVE-2026-15409","description":"CVE-2026-15409 - Dectect","modified":"2026-07-15T02:46:49Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-15409","url":"https://github.com/HORKimhab/CVE-2026-15409"},{"source":"poc-in-github","sourceId":"CVE-2026-15409","modified":"2026-07-15T02:46:49Z","url":"https://github.com/HORKimhab/CVE-2026-15409"}],"tags":[]},{"url":"https://github.com/remmons-r7/rapid7-CVE-2026-15409","source":"poc-in-github","sourceId":"CVE-2026-15409","description":"This repo contains a proof-of-concept exploit for CVE-2026-15409. It establishes non-root remote code execution on SonicWall SMA 1000 by implementing the Erlang protocol expected by localhost:1050 and tunneling it through the websocket for file r/w and arbitrary code execution via RPC calls.","modified":"2026-09-12T08:48:21Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-15409","url":"https://github.com/remmons-r7/rapid7-CVE-2026-15409"},{"source":"poc-in-github","sourceId":"CVE-2026-15409","modified":"2026-09-12T08:48:21Z","url":"https://github.com/remmons-r7/rapid7-CVE-2026-15409"}],"tags":[]},{"url":"https://github.com/0xBlackash/CVE-2026-15409","source":"poc-in-github","sourceId":"CVE-2026-15409","description":"CVE-2026-15409","modified":"2026-07-26T17:57:44Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-15409","url":"https://github.com/0xBlackash/CVE-2026-15409"},{"source":"poc-in-github","sourceId":"CVE-2026-15409","modified":"2026-07-26T17:57:44Z","url":"https://github.com/0xBlackash/CVE-2026-15409"}],"tags":[]},{"url":"https://github.com/MrRawBit/SonicWall-SMA1000-Zero-Day-IoC-Check","source":"poc-in-github","sourceId":"CVE-2026-15409","description":"Unofficial Bash IoC checker for SonicWall SMA1000 appliances affected by actively exploited CVE-2026-15409 and CVE-2026-15410.","modified":"2026-07-16T08:38:18Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-15409","url":"https://github.com/MrRawBit/SonicWall-SMA1000-Zero-Day-IoC-Check"},{"source":"poc-in-github","sourceId":"CVE-2026-15409","modified":"2026-07-16T08:38:18Z","url":"https://github.com/MrRawBit/SonicWall-SMA1000-Zero-Day-IoC-Check"}],"tags":[]},{"url":"https://github.com/tc4dy/CVE-2026-15409-15410-Framework","source":"poc-in-github","sourceId":"CVE-2026-15409","description":"CVE-2026-15409/15410 SonicWall SMA1000 multi-exploit Framework - SSRF→Erlang RPC→RCE→root privesc. Features: --detect safe check, --exec, --read-file, --privesc, --rpc, interactive shell, batch threading, file write, ws-url override, pipe support. KEV listed CVSS 10.0 actively exploited. Authorized testing only. Use Ethically, Stay Legal. ","modified":"2026-10-13T16:08:42Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-15409","url":"https://github.com/tc4dy/CVE-2026-15409-15410-Framework"},{"source":"poc-in-github","sourceId":"CVE-2026-15409","modified":"2026-10-13T16:08:42Z","url":"https://github.com/tc4dy/CVE-2026-15409-15410-Framework"}],"tags":[]},{"url":"https://github.com/Ch4120N/CVE-2026-15409","source":"poc-in-github","sourceId":"CVE-2026-15409","description":"Proof-of-Concept exploit for CVE-2026-15409 (SonicWall SMA 1000 RCE) via Erlang distribution over WebSocket. Achieves unauthenticated remote code execution as couchdb user.","modified":"2026-08-08T07:32:05Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-15409","url":"https://github.com/Ch4120N/CVE-2026-15409"},{"source":"poc-in-github","sourceId":"CVE-2026-15409","modified":"2026-08-08T07:32:05Z","url":"https://github.com/Ch4120N/CVE-2026-15409"}],"tags":[]}],"test_commands":[{"tool":"nuclei","cmd":"nuclei -id CVE-2026-15409 -u https://TARGET","note":"Detection template — review its checks and affected versions before use."},{"tool":"poc.json","cmd":"curl -s https://vulnpedia.com/cve/CVE-2026-15409/poc.json","note":"Machine-readable PoC index for this CVE (for automation)."}],"detection_sources":[{"kind":"nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2026/CVE-2026-15409.yaml","template":"javascript/cves/2026/CVE-2026-15409.yaml","executable":true}],"discovery_links":[{"kind":"github-search","url":"https://github.com/search?q=%22CVE-2026-15409%22&type=repositories","executable":false}]}