CVE-2026-15497: SonicCloudOrg sonic-agent RCE Vulnerability

CVE-2026-15497 Overview

CVE-2026-15497 is a code injection vulnerability [CWE-74] affecting SonicCloudOrg sonic-agent versions up to 2.7.2. The flaw resides in an unknown function within sonic-server-controller/src/main/java/org/cloud/sonic/controller/controller/ExchangeController.java, part of the JWT Authentication Filter component. Attackers can trigger the vulnerability remotely without authentication. A public proof-of-concept exists, and the vendor did not respond to disclosure attempts. The affected product line is no longer supported by the maintainer, meaning no official patch will be issued.

Critical Impact
Remote, unauthenticated attackers can inject code through the JWT Authentication Filter in an end-of-life product with no vendor patch available.

Affected Products

SonicCloudOrg sonic-agent versions up to and including 2.7.2
sonic-server-controller component containing ExchangeController.java
Deployments using the JWT Authentication Filter in unsupported sonic-agent builds

Discovery Timeline

2026-07-12 - CVE-2026-15497 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15497

Vulnerability Analysis

The vulnerability affects the JWT Authentication Filter within the sonic-server-controller module of sonic-agent. Specifically, an unspecified function in ExchangeController.java processes attacker-controlled input in a way that permits code injection [CWE-74]. Because the flaw is reachable through the authentication filter itself, exploitation does not require valid credentials or user interaction. The attack is initiated over the network against exposed sonic-agent instances.

The injected payload is interpreted by the server-side controller, allowing an attacker to influence application logic through crafted requests. The public proof-of-concept demonstrates unauthenticated abuse of the exchange send endpoint. Because sonic-agent is used in mobile and device automation testing environments, successful exploitation can pivot into connected test devices, CI pipelines, or lab networks.

Root Cause

The root cause is improper neutralization of special elements in data passed through the JWT Authentication Filter. Input reaching ExchangeController.java is not adequately validated or sanitized before it is used in a downstream execution or evaluation context. The filter runs before application-level authentication checks, exposing the injection sink to unauthenticated requests.

Attack Vector

The attack vector is network-based with low complexity and requires no privileges or user interaction. An attacker sends a crafted HTTP request targeting the exchange controller endpoint that traverses the JWT Authentication Filter. The malicious payload is embedded within request parameters or headers processed by the vulnerable function. See the GitHub PoC Repository and the VulDB Vulnerability Detail for reproduction details.

// No verified exploitation code is reproduced here.
// Refer to the linked PoC repository for technical details.

Detection Methods for CVE-2026-15497

Indicators of Compromise

Unauthenticated HTTP requests to sonic-server-controller endpoints handled by ExchangeController.java, particularly exchange send routes
Malformed or oversized JWT headers routed through the JWT Authentication Filter
Unexpected outbound connections or child processes spawned from the sonic-agent Java process
Log entries showing filter processing followed by controller-level errors, deserialization traces, or scripting engine invocations

Detection Strategies

Inspect application and reverse-proxy logs for anomalous request patterns targeting /exchange or related controller routes without valid authentication
Baseline normal sonic-agent process behavior and alert on new command execution, file writes outside working directories, or unexpected network egress
Monitor Java runtime metrics for scripting engine or reflection API usage that does not match legitimate application flow

Monitoring Recommendations

Enable verbose request logging on any web application firewall or reverse proxy in front of sonic-agent
Forward sonic-agent host telemetry to a centralized SIEM and correlate authentication filter events with process activity
Track outbound connections from the sonic-agent host to non-standard destinations, which may indicate post-exploitation staging

How to Mitigate CVE-2026-15497

Immediate Actions Required

Remove sonic-agent 2.7.2 and earlier from internet-exposed environments, since the product is end-of-life and will not receive vendor patches
Restrict access to sonic-server-controller endpoints to trusted management networks using firewall or reverse-proxy rules
Audit deployments for existing compromise indicators, especially unauthenticated activity against the exchange controller

Patch Information

No vendor patch is available. According to the NVD record and the VulDB CVE Record, the vendor did not respond to disclosure attempts, and the affected versions are no longer supported by the maintainer. Organizations should plan migration to a supported alternative or maintain a self-managed fork with hardened input validation on the JWT Authentication Filter and ExchangeController.java.

Workarounds

Place sonic-agent behind an authenticating reverse proxy that enforces strong access controls before requests reach the JWT filter
Deploy a web application firewall rule set that blocks suspicious payloads targeting exchange endpoints and unusual JWT structures
Segment sonic-agent hosts from production networks and connected test devices to limit blast radius if exploitation succeeds
Disable or remove the exchange send functionality if it is not required by your workflow

bash

# Example: restrict sonic-server-controller access to a management subnet
iptables -A INPUT -p tcp --dport 7799 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7799 -j DROP