If you manage a SonicWall SMA 1000 running one of the affected platform hotfix builds, update it to a current vendor-supported fixed hotfix, then verify the running pform version after restart. SonicWall’s July 16, 2026 notice identifies the unauthenticated server-side request forgery as CVE-2026-15409, rates it CVSS 10.0 (Critical), and reports active exploitation in real internet environments. Patching closes the known flaw; it does not show whether an appliance was compromised before the update.
Check whether your SMA 1000 is in scope
SonicWall describes CVE-2026-15409 as an SSRF vulnerability in the SMA 1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended locations. The affected product list in SonicWall’s July 16, 2026 notice includes SMA 6210, SMA 7210, SMA 8200v, and CMS across hypervisors.
As an Amazon Associate I earn from qualifying purchases.
The same notice also addresses CVE-2026-15410, a separate remote-code-execution vulnerability. Do not treat that RCE as the SSRF discussed here or assume the two vulnerabilities have identical remediation details.
Compare the platform hotfix, not just the model
The version that determines whether the appliance meets the listed fixed threshold is its platform hotfix, shown as pform. Compare builds within the appliance’s release branch; do not assume that a higher-looking number in a different branch is equivalent.
#1 Best Overall
- SonicWall Firewall SSL VPN - License (01-SSC-8630)
- Secure Remote User Access: Enables encrypted VPN connections to SonicWall firewalls for users working from home, on the road, or at branch locations.
- Clientless Browser-Based VPN: Users can securely access internal resources through web browsers without requiring a dedicated VPN client.
- Policy-Based Access Controls: Enforce granular access by user, device, time, or application with full integration into LDAP, AD, or RADIUS.
- Supports Windows, macOS, and Mobile Devices: Ensure secure access across diverse platforms, including laptops, tablets, and smartphones.
| Release branch | Affected pform builds listed by SonicWall | Fixed threshold listed by SonicWall |
|---|---|---|
| 12.4.3 | 12.4.3-03245, 12.4.3-03387, 12.4.3-03434 | 12.4.3-03453 or later in this branch |
| 12.5.0 | 12.5.0-02283, 12.5.0-02624, 12.5.0-02800 | 12.5.0-02835 or later in this branch |
These are the builds and thresholds in the July notice, not a guarantee that they remain the latest available. SonicWall says to upgrade to the latest hotfix. Check the current notice and the download offered for your registered appliance in MySonicWall before choosing an update; model name alone is not enough to select a file.
Find the installed pform build in AMC or CMC
Record the appliance model, release branch, and exact pform version before updating. The popup also shows the client hotfix version, clt; note it separately rather than using it in place of pform for the branch comparison.
Rank #2
- SonicWall Firewall SSL VPN - License (01-SSC-8633)
- Secure Remote User Access: Enables encrypted VPN connections to SonicWall firewalls for users working from home, on the road, or at branch locations.
- Clientless Browser-Based VPN: Users can securely access internal resources through web browsers without requiring a dedicated VPN client.
- Policy-Based Access Controls: Enforce granular access by user, device, time, or application with full integration into LDAP, AD, or RADIUS.
- Supports Windows, macOS, and Mobile Devices: Ensure secure access across diverse platforms, including laptops, tablets, and smartphones.
In AMC
- Sign in to AMC.
- Go to System Configuration > Maintenance.
- Click the orange hotfix link. In the popup, record the platform (
pform) and client (clt) hotfix versions.
In CMC
- Sign in to CMC.
- Go to Management Server > Maintain > Maintain Server.
- Click the orange hotfix link and record the displayed pform and clt versions.
If the device is in scope and its pform build matches one of the affected builds listed above, treat it as affected. If it runs a different build or branch, use SonicWall’s current affected-build list and the registered device’s supported release information rather than inferring status from the version string alone.
Obtain and install the supported hotfix
- Check the current vendor instructions. In MySonicWall, use the registered appliance to identify the supported download and release branch. Follow the latest SonicWall notice and the release-specific instructions for that device.
- Prepare the update in AMC. SonicWall’s SMA 12.5 upgrade guide describes selecting the hotfix or update in AMC and importing the downloaded file through System Configuration > Maintenance > System software updates.
- Install or schedule the update. The guide describes installing immediately or scheduling through the advanced options. Follow the instructions applicable to the appliance and selected release.
- Apply the platform hotfix before the client hotfix. SonicWall’s guide says platform hotfixes should be applied first. Related client hotfixes may also be needed to resolve all issues addressed by a hotfix set, so follow the release-specific sequence rather than assuming the pform update is the only required update.
- Allow the appliance to restart. Do not regard the update as verified until the appliance has restarted and the running version has been checked.
Verify the running version after restart
- Sign in to AMC and open Dashboard > System.
- Under System Information, check the new version details.
- Open the hotfix display again in AMC or CMC and confirm that the pform build is at or above the fixed threshold for its branch—or is the later supported build SonicWall currently directs you to install.
- Save the before-and-after model, branch, pform and clt versions, update time, and restart result in the change record.
If the displayed build has not changed as expected, or the appliance is not operating normally, do not assume the update succeeded. Check the applicable SonicWall installation instructions and contact SonicWall support before attempting another update based on guesswork.
Rank #3
- SonicWall Gateway Anti-Malware, Intrusion Prevention & Application Control for TZ370 - 1 Year License (02-SSC-6589)
- Real-Time Malware Scanning: Block viruses, spyware, and ransomware at the gateway before they reach endpoints or servers.
- Intrusion Prevention System (IPS): Detect and stop network-based attacks, exploits, and denial-of-service attempts using constantly updated threat signatures.
- Application Intelligence & Control: Identify, monitor, and restrict the use of applications to enforce policies and reduce bandwidth abuse.
- Low-Latency Deep Packet Inspection: Analyze traffic without slowing performance, using SonicWall's patented Reassembly-Free DPI engine.
Check for signs of compromise, not just patch status
Because SonicWall reported active exploitation, include a forensic review in the response. A fixed pform confirms the running version; it cannot establish that the appliance was never accessed or altered. SonicWall’s notice lists these indicators to investigate:
- In
extraweb_access.log, HTTP 200 requests to/__api__/loginor/__api__/logout. - In
extraweb_access.log, HTTP 101 requests to/wsproxywith suspicious host parameters. - In
ctrl-service.log, entries involving “hotfix removal” and path-traversal names. - In
/var/lib/unit/conf.json, routes containing/__api__/loginor/__api__/logout.
These are vendor-listed indicators, not a complete assurance that an appliance is clean when none are found. Preserve relevant logs and coordinate analysis with SonicWall support or a qualified incident-response team. SonicWall advises opening a support case for questions about identifying the indicators.
Rank #4
- SonicWall Gateway Anti-Malware, Intrusion Prevention & Application Control for TZ470 - 1 Year License (02-SSC-6423)
- Real-Time Malware Scanning: Block viruses, spyware, and ransomware at the gateway before they reach endpoints or servers.
- Intrusion Prevention System (IPS): Detect and stop network-based attacks, exploits, and denial-of-service attempts using constantly updated threat signatures.
- Application Intelligence & Control: Identify, monitor, and restrict the use of applications to enforce policies and reduce bandwidth abuse.
- Low-Latency Deep Packet Inspection: Analyze traffic without slowing performance, using SonicWall's patented Reassembly-Free DPI engine.
If indicators are present, follow the compromise-recovery path
SonicWall’s notice directs organizations with indicators of compromise to re-image physical hardware or redeploy virtual appliances, change user and administrator passwords, and reset TOTP tokens. It recommends restoring a configuration backup made before the December hotfix builds—12.4.3-03245 or 12.5.0-02283. If no such backup exists, SonicWall recommends carefully auditing the backup for tampering.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Where feasible, preserve logs and coordinate forensic work before destructive recovery steps. A routine hotfix installation is not a substitute for this recovery guidance when indicators are present.
Best Value
- SonicWall Firewall SSL VPN - License (01-SSC-6118)
- Secure Remote User Access: Enables encrypted VPN connections to SonicWall firewalls for users working from home, on the road, or at branch locations.
- Clientless Browser-Based VPN: Users can securely access internal resources through web browsers without requiring a dedicated VPN client.
- Policy-Based Access Controls: Enforce granular access by user, device, time, or application with full integration into LDAP, AD, or RADIUS.
- Supports Windows, macOS, and Mobile Devices: Ensure secure access across diverse platforms, including laptops, tablets, and smartphones.
Physical SMA 6210 and SMA 7210 re-imaging
SonicWall documents a recovery procedure for SMA 6210 and SMA 7210 hardware that uses a serial console connection and the appliance’s recovery partition to restore factory-shipped firmware. Afterward, the appliance still needs a current supported release installed. SonicWall states that FIPS mode must be disabled for this documented process. This is a conditional recovery procedure for suspected compromise, not a step in ordinary hotfix installation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
