CVE-2026-15410 ctrl-service remove_hotfix path traversal to root shutdown
Detects a multi-stage exploitation chain for CVE-2026-15410 targeting SonicWall SMA 1000 appliances. It correlates web request logs containing path traversal sequences in a hotfix parameter, associated application log entries indicating removal of a hotfix referencing a temporary file, and subsequent system shutdown commands executed with root privileges, indicating successful privilege escalation and system compromise.
Microsoft Sentinel (KQL)
