{"schema":"vulnpedia.research/1","cve":"CVE-2026-15409","references":[{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008","tags":["vendor-advisory","Vendor Advisory","KEV report"],"source":"mitre","sourceId":"sonicwall","modified":"2026-07-14T19:43:54.725Z","origins":[{"source":"mitre","sourceId":"sonicwall","modified":"2026-07-14T19:43:54.725Z","url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008"},{"source":"nvd","sourceId":"CVE-2026-15409","modified":"2026-10-24T21:10:00.130","url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008"},{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008"}]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409","tags":["government-resource","US Government Resource"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-08-04T03:56:14.089Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-08-04T03:56:14.089Z","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409"},{"source":"nvd","sourceId":"CVE-2026-15409","modified":"2026-10-24T21:10:00.130","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409"}]},{"source":"euvd","sourceId":"EUVD-2026-44404","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44404","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-44404","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44404"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://previdian.com/CVE-2026-15409","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","url":"https://previdian.com/CVE-2026-15409"}]},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"url":"https://www.rapid7.com/blog/post/etr-rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","url":"https://www.rapid7.com/blog/post/etr-rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410/"}]},{"url":"https://www.tenable.com/blog/cve-2026-15409-cve-2026-15410-sonicwall-sma-1000-zero-day-vulnerabilities-exploited-in-the","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","url":"https://www.tenable.com/blog/cve-2026-15409-cve-2026-15410-sonicwall-sma-1000-zero-day-vulnerabilities-exploited-in-the"}]},{"url":"https://cydome.io/maritime-cybersecurity-bulletin-july-17th-2026/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","url":"https://cydome.io/maritime-cybersecurity-bulletin-july-17th-2026/"}]},{"url":"https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","url":"https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/"}]},{"url":"https://research.checkpoint.com/2026/20th-july-threat-intelligence-report/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","url":"https://research.checkpoint.com/2026/20th-july-threat-intelligence-report/"}]},{"url":"https://www.resecurity.com/es/blog/article/from-wsproxy-to-root-inc-ransomware-and-sonicwall-sma-exploit-chain","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","url":"https://www.resecurity.com/es/blog/article/from-wsproxy-to-root-inc-ransomware-and-sonicwall-sma-exploit-chain"}]},{"url":"https://www.cyfirma.com/research/tracking-ransomware-jul-2026/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","url":"https://www.cyfirma.com/research/tracking-ransomware-jul-2026/"}]},{"url":"https://cydome.io/maritime-cybersecurity-bulletin-august-7th-2026/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","url":"https://cydome.io/maritime-cybersecurity-bulletin-august-7th-2026/"}]},{"url":"https://www.recordedfuture.com/blog/july-2026-cve-landscape","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","url":"https://www.recordedfuture.com/blog/july-2026-cve-landscape"}]},{"url":"https://blackpointcyber.com/blog/cve-analysis-july-2026/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","url":"https://blackpointcyber.com/blog/cve-analysis-july-2026/"}]},{"url":"https://www.acn.gov.it/portale/documents/20119/1300791/Operational_Summary_lug26_CLEAR.pdf/88b05799-3e4c-f3ed-4a42-d9e68e080604?t=1787220905144","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","url":"https://www.acn.gov.it/portale/documents/20119/1300791/Operational_Summary_lug26_CLEAR.pdf/88b05799-3e4c-f3ed-4a42-d9e68e080604?t=1787220905144"}]},{"url":"https://www.sentinelone.com/blog/what-two-independent-datasets-reveal-about-whos-exploiting-your-perimeter/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","url":"https://www.sentinelone.com/blog/what-two-independent-datasets-reveal-about-whos-exploiting-your-perimeter/"}]},{"url":"https://www.cyfirma.com/research/tracking-ransomware-aug-2026/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","url":"https://www.cyfirma.com/research/tracking-ransomware-aug-2026/"}]},{"url":"https://hunt.io/blog/sonicwall-sma1000-uk-council-attack","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","url":"https://hunt.io/blog/sonicwall-sma1000-uk-council-attack"}]},{"url":"https://vulncheck.com/xdb/b72cb64708d2","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"b72cb64708d2","modified":"2026-07-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"b72cb64708d2","modified":"2026-07-14T00:00:00Z","url":"https://vulncheck.com/xdb/b72cb64708d2"}]},{"url":"https://github.com/remmons-r7/rapid7-CVE-2026-15409","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"b72cb64708d2","modified":"2026-07-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"b72cb64708d2","modified":"2026-07-14T00:00:00Z","url":"https://github.com/remmons-r7/rapid7-CVE-2026-15409"}]}],"packages":[],"pocCandidates":[{"url":"https://github.com/HORKimhab/CVE-2026-15409","source":"poc-in-github","sourceId":"CVE-2026-15409","description":"CVE-2026-15409 - Dectect","modified":"2026-07-15T02:46:49Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-15409","url":"https://github.com/HORKimhab/CVE-2026-15409"},{"source":"poc-in-github","sourceId":"CVE-2026-15409","modified":"2026-07-15T02:46:49Z","url":"https://github.com/HORKimhab/CVE-2026-15409"}],"tags":[]},{"url":"https://github.com/remmons-r7/rapid7-CVE-2026-15409","source":"poc-in-github","sourceId":"CVE-2026-15409","description":"This repo contains a proof-of-concept exploit for CVE-2026-15409. It establishes non-root remote code execution on SonicWall SMA 1000 by implementing the Erlang protocol expected by localhost:1050 and tunneling it through the websocket for file r/w and arbitrary code execution via RPC calls.","modified":"2026-09-12T08:48:21Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-15409","url":"https://github.com/remmons-r7/rapid7-CVE-2026-15409"},{"source":"poc-in-github","sourceId":"CVE-2026-15409","modified":"2026-09-12T08:48:21Z","url":"https://github.com/remmons-r7/rapid7-CVE-2026-15409"}],"tags":[]},{"url":"https://github.com/0xBlackash/CVE-2026-15409","source":"poc-in-github","sourceId":"CVE-2026-15409","description":"CVE-2026-15409","modified":"2026-07-26T17:57:44Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-15409","url":"https://github.com/0xBlackash/CVE-2026-15409"},{"source":"poc-in-github","sourceId":"CVE-2026-15409","modified":"2026-07-26T17:57:44Z","url":"https://github.com/0xBlackash/CVE-2026-15409"}],"tags":[]},{"url":"https://github.com/MrRawBit/SonicWall-SMA1000-Zero-Day-IoC-Check","source":"poc-in-github","sourceId":"CVE-2026-15409","description":"Unofficial Bash IoC checker for SonicWall SMA1000 appliances affected by actively exploited CVE-2026-15409 and CVE-2026-15410.","modified":"2026-07-16T08:38:18Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-15409","url":"https://github.com/MrRawBit/SonicWall-SMA1000-Zero-Day-IoC-Check"},{"source":"poc-in-github","sourceId":"CVE-2026-15409","modified":"2026-07-16T08:38:18Z","url":"https://github.com/MrRawBit/SonicWall-SMA1000-Zero-Day-IoC-Check"}],"tags":[]},{"url":"https://github.com/tc4dy/CVE-2026-15409-15410-Framework","source":"poc-in-github","sourceId":"CVE-2026-15409","description":"CVE-2026-15409/15410 SonicWall SMA1000 multi-exploit Framework - SSRF→Erlang RPC→RCE→root privesc. Features: --detect safe check, --exec, --read-file, --privesc, --rpc, interactive shell, batch threading, file write, ws-url override, pipe support. KEV listed CVSS 10.0 actively exploited. Authorized testing only. Use Ethically, Stay Legal. ","modified":"2026-10-13T16:08:42Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-15409","url":"https://github.com/tc4dy/CVE-2026-15409-15410-Framework"},{"source":"poc-in-github","sourceId":"CVE-2026-15409","modified":"2026-10-13T16:08:42Z","url":"https://github.com/tc4dy/CVE-2026-15409-15410-Framework"}],"tags":[]},{"url":"https://github.com/Ch4120N/CVE-2026-15409","source":"poc-in-github","sourceId":"CVE-2026-15409","description":"Proof-of-Concept exploit for CVE-2026-15409 (SonicWall SMA 1000 RCE) via Erlang distribution over WebSocket. Achieves unauthenticated remote code execution as couchdb user.","modified":"2026-08-08T07:32:05Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-15409","url":"https://github.com/Ch4120N/CVE-2026-15409"},{"source":"poc-in-github","sourceId":"CVE-2026-15409","modified":"2026-08-08T07:32:05Z","url":"https://github.com/Ch4120N/CVE-2026-15409"}],"tags":[]}],"cataloguedPoc":[{"url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/sonicwall_sma1000_wsproxy_rce.rb","source":"metasploit","sourceId":"exploit/linux/http/sonicwall_sma1000_wsproxy_rce","description":"SonicWall SMA1000 WorkPlace wsproxy SSRF Remote Command Execution","modified":"2026-07-29 15:13:38 +0000","kind":"metasploit","verification":"catalogued","origins":[{"source":"metasploit","sourceId":"exploit/linux/http/sonicwall_sma1000_wsproxy_rce","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/sonicwall_sma1000_wsproxy_rce.rb"},{"source":"metasploit","sourceId":"exploit/linux/http/sonicwall_sma1000_wsproxy_rce","modified":"2026-07-29 15:13:38 +0000","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/sonicwall_sma1000_wsproxy_rce.rb"}],"tags":[]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"b72cb64708d2","url":"https://vulncheck.com/xdb/b72cb64708d2","cve":"CVE-2026-15409","dateAdded":"2026-07-15T17:49:41Z","modified":"2026-07-14T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/remmons-r7/rapid7-CVE-2026-15409","observations":[{"dateAdded":"2026-07-15T17:49:41Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"b72cb64708d2","modified":"2026-07-14T00:00:00Z","url":"https://vulncheck.com/xdb/b72cb64708d2"}]}],"vendorStatements":[],"exploitationSources":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2026-07-14T00:00:00Z","modified":"2026-07-14T00:00:00Z","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Known","reportedByVulncheckCanaries":false,"vendorProject":"SonicWall","product":"SMA1000 Appliances","dueDate":"2026-07-17T00:00:00Z","cisaDateAdded":"2026-07-14T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","modified":"2026-07-14T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","catalog":"VulnCheck KEV","kind":"report","url":"https://previdian.com/CVE-2026-15409","dateAdded":"2026-07-14T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","url":"https://previdian.com/CVE-2026-15409"},{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008"},{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","catalog":"VulnCheck KEV","kind":"report","url":"https://www.rapid7.com/blog/post/etr-rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410/","dateAdded":"2026-07-15T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","url":"https://www.rapid7.com/blog/post/etr-rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410/"},{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","url":"https://www.tenable.com/blog/cve-2026-15409-cve-2026-15410-sonicwall-sma-1000-zero-day-vulnerabilities-exploited-in-the"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","catalog":"VulnCheck KEV","kind":"report","url":"https://cydome.io/maritime-cybersecurity-bulletin-july-17th-2026/","dateAdded":"2026-07-17T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","url":"https://cydome.io/maritime-cybersecurity-bulletin-july-17th-2026/"},{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","url":"https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","catalog":"VulnCheck KEV","kind":"report","url":"https://research.checkpoint.com/2026/20th-july-threat-intelligence-report/","dateAdded":"2026-07-20T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","url":"https://research.checkpoint.com/2026/20th-july-threat-intelligence-report/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","catalog":"VulnCheck KEV","kind":"report","url":"https://www.resecurity.com/es/blog/article/from-wsproxy-to-root-inc-ransomware-and-sonicwall-sma-exploit-chain","dateAdded":"2026-08-01T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","url":"https://www.resecurity.com/es/blog/article/from-wsproxy-to-root-inc-ransomware-and-sonicwall-sma-exploit-chain"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","catalog":"VulnCheck KEV","kind":"report","url":"https://www.cyfirma.com/research/tracking-ransomware-jul-2026/","dateAdded":"2026-08-06T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","url":"https://www.cyfirma.com/research/tracking-ransomware-jul-2026/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","catalog":"VulnCheck KEV","kind":"report","url":"https://cydome.io/maritime-cybersecurity-bulletin-august-7th-2026/","dateAdded":"2026-08-07T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","url":"https://cydome.io/maritime-cybersecurity-bulletin-august-7th-2026/"},{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","url":"https://www.recordedfuture.com/blog/july-2026-cve-landscape"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","catalog":"VulnCheck KEV","kind":"report","url":"https://blackpointcyber.com/blog/cve-analysis-july-2026/","dateAdded":"2026-08-17T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","url":"https://blackpointcyber.com/blog/cve-analysis-july-2026/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","catalog":"VulnCheck KEV","kind":"report","url":"https://www.acn.gov.it/portale/documents/20119/1300791/Operational_Summary_lug26_CLEAR.pdf/88b05799-3e4c-f3ed-4a42-d9e68e080604?t=1787220905144","dateAdded":"2026-08-20T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","url":"https://www.acn.gov.it/portale/documents/20119/1300791/Operational_Summary_lug26_CLEAR.pdf/88b05799-3e4c-f3ed-4a42-d9e68e080604?t=1787220905144"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","catalog":"VulnCheck KEV","kind":"report","url":"https://www.sentinelone.com/blog/what-two-independent-datasets-reveal-about-whos-exploiting-your-perimeter/","dateAdded":"2026-08-26T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","url":"https://www.sentinelone.com/blog/what-two-independent-datasets-reveal-about-whos-exploiting-your-perimeter/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","catalog":"VulnCheck KEV","kind":"report","url":"https://www.cyfirma.com/research/tracking-ransomware-aug-2026/","dateAdded":"2026-09-07T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","url":"https://www.cyfirma.com/research/tracking-ransomware-aug-2026/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","catalog":"VulnCheck KEV","kind":"report","url":"https://hunt.io/blog/sonicwall-sma1000-uk-council-attack","dateAdded":"2026-09-10T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-15409","url":"https://hunt.io/blog/sonicwall-sma1000-uk-council-attack"}]}]}