KEV Lag Tracker → CVE-2026-15409. Data verified against the official CISA KEV catalog and the National Vulnerability Database.
CISA added CVE-2026-15409 (SonicWall SMA1000 Appliances) to the Known Exploited Vulnerabilities catalog on July 14, 2026. CISA listed it as actively exploited 0 days before its NVD publication date — exploitation was confirmed at or before public disclosure. A KEV listing is CISA’s official confirmation that a vulnerability is being exploited in the wild.
The Record
| CVE | CVE-2026-15409 |
| Vendor / product | SonicWall SMA1000 Appliances |
| Vulnerability | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability |
| CVSS base score | 10 |
| NVD publication date | July 14, 2026 |
| Added to CISA KEV | July 14, 2026 |
| Lag (public → KEV listing) | 0 days |
| Federal patch deadline | July 17, 2026 |
| Known ransomware use | No |
Measured against the 1674 entries in our tracker with verified publication dates, CVE-2026-15409 was flagged faster than 87% of them.
What CISA Reported
CISA describes the flaw as follows: “SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.”
Federal Patch Deadline
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-15409 by July 17, 2026 — a 3-day remediation window from the KEV listing date. Private organizations are not bound by that deadline; CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
What EPSS Forecast Before the Confirmation
EPSS had no score for CVE-2026-15409 on the day before CISA confirmed exploitation. That normally means the CVE had not yet been published when it was already being exploited — a case no forecast could have flagged. Its current EPSS probability is 83.66%. See the EPSS accuracy analysis for how often this happens.
How This Compares to SonicWall’s Track Record
At 0 days, CVE-2026-15409 was flagged faster than SonicWall’s 208-day median across the 17 of its KEV entries with verified publication dates. SonicWall currently ranks #25 on our KEV Lag leaderboard.
| SonicWall in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 17 |
| Median lag (public → KEV listing) | 208 days |
| 0-day rate (exploited at or before disclosure) | 18% |
| Entries tied to known ransomware campaigns | 10 |
Other Recent SonicWall KEV Additions
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-15410 | SMA1000 Appliances | July 14, 2026 | 0 | No |
| CVE-2025-40602 | SMA1000 appliance | December 17, 2025 | -1 | No |
| CVE-2023-44221 | SMA100 Appliances | May 1, 2025 | 513 | No |
| CVE-2021-20035 | SMA100 Appliances | April 16, 2025 | 1297 | No |
| CVE-2024-53704 | SonicOS | February 18, 2025 | 40 | ⚠️ Yes |
Defense guide: How to Detect Zero-day Vulnerability: Attack Chain & Defense — detection signals, attack chain and response steps for this class of attack.
Frequently Asked Questions
What is CVE-2026-15409?
CVE-2026-15409 is a vulnerability in SonicWall SMA1000 Appliances (SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability) that CISA added to its Known Exploited Vulnerabilities catalog on July 14, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild.
How long was CVE-2026-15409 public before CISA confirmed exploitation?
0 days before its NVD publication date — CISA listed it as exploited at or before the vulnerability was formally published, which is the signature of a zero-day.
What is the federal patch deadline for CVE-2026-15409?
U.S. federal agencies must remediate CVE-2026-15409 by July 17, 2026, a 3-day window from the KEV listing date. Private organizations are not bound by that deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
Is CVE-2026-15409 used in ransomware campaigns?
CISA has not flagged CVE-2026-15409 as known to be used in ransomware campaigns. That field reflects confirmed campaign use, not the absence of risk.
How does this compare to other SonicWall vulnerabilities?
Across 17 SonicWall entries with verified publication dates, the median lag is 208 days and 18% were exploited at or before disclosure. CVE-2026-15409, at 0 days, is faster than that median.
Related Coverage
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
- WordPress’s CVE-2026-63030 Was Exploited in 4 Days — Well Under Its 420-Day Median (July 2026)
Primary Sources
- CISA Known Exploited Vulnerabilities Catalog — the official listing that confirms active exploitation, and the source of the KEV date on this page.
- NVD — CVE-2026-15409 — publication date, CVSS score and the full technical record.
- Vendor advisory — psirt.global.sonicwall.com — SonicWall’s own disclosure, with the affected versions and the fix.
How We Track This
This page is generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No date or figure on this page is estimated or taken from a third-party source — they come directly from CISA and NVD records. Free to cite with attribution to CVEDaily (CC BY 4.0).