This vulnerability (CVE-2026-15409) is a server-side request forgery (SSRF) issue in the SonicWall SMA1000 Appliance Work Place interface. An unauthenticated remote attacker can exploit this flaw to induce the appliance to send requests to arbitrary locations, which may lead to complete compromise of confidentiality, integrity, and availability of the affected system. The CVSS v3.1 base score is 10.0 (critical), reflecting network attack vector, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability. The affected versions explicitly identified are 12.4.3-03245 and 12.5.0-02283. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported as of the publication date.

Successful exploitation can result in complete compromise of the affected SonicWall SMA1000 appliance, including full loss of confidentiality, integrity, and availability. The attacker can cause the device to make arbitrary requests, potentially accessing internal resources or services not otherwise reachable, which may lead to further attacks or data exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published by SonicWall at this time. Users should monitor SonicWall advisories closely for updates and apply any forthcoming patches promptly.