SonicWall vulnerabilities in CISA KEV
SonicWall has 19 vulnerabilities in CISA's catalogue of flaws known to be exploited, the 14th highest of any vendor. 5 were added in the last 12 months; 13 are linked to known ransomware use (68.4% of its entries, against 20.4% across the catalogue). CISA's median fix window for these entries is 14 days (range 3 to 181), against 21 days (range 1 to 184) across the whole catalogue. The most exploited product is SMA1000 Appliances, with 5 entries. Other frequently affected products: SonicOS (3); SonicWall Email Security (3).
Catalog v2026.11.04, released 5 Nov 2026. Source CISA ↗. All KEV entries.
$ ./kev --vendor sonicwall --summary
Counts are computed from the catalog release on ; the 12 month window ends there.
┌─ total entries
19
in CISA KEV
┌─ first added
2021-11-03
earliest entry
┌─ latest added
2026-09-02
most recent entry
┌─ last 12 months
5
entries added
┌─ ransomware use
13 of 19
68.4% linked to ransomware
┌─ distinct products
9
affected products
$ awk -F, {print $1} /var/log/kev/sonicwall.log | uniq -c
Entries by the year CISA added them.
| Year | Entries added | Of which ransomware |
|---|---|---|
| 2021 | 5 | 5 |
| 2022 | 4 | 3 |
| 2024 | 1 | 1 |
| 2025 | 5 | 2 |
| 2026 | 4 | 2 |
$ sort /var/log/kev/sonicwall.log | uniq -c | sort -rn | head -5
The five products with the most entries in the catalogue.
- SMA1000 Appliances 5 entries
- SonicOS 3 entries
- SonicWall Email Security 3 entries
- SMA100 2 entries
- SMA100 Appliances 2 entries
$ kev-due-dates --vendor sonicwall
Days between the date CISA added an entry and the due date it set, median and range. Due dates apply to US federal agencies; for everyone else they are a patch-first ranking signal.
┌─ SonicWall
14 days (range 3 to 181)
median and range in days
┌─ whole catalogue
21 days (range 1 to 184)
median and range in days
$ grep -o 'CWE-[0-9]*' /var/log/kev/sonicwall.log | sort | uniq -c | sort -rn | head -3
Weakness types CISA records for these entries (19 of 19 have at least one CWE).
$ grep -ril 'SonicWall' /var/log/news | head -5
Our reporting that names SonicWall or one of its KEV CVE ids, newest first.
┌─ /var/log/news
Patch Week pages with these entries
$ wc -l ./sonicwall.kev · 19 rows
Descriptions: CISA Known Exploited Vulnerabilities catalogue
- CVE-2026-83548
SMA1000 Appliances
SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
due 2026-09-05 · CWE-918 CWE-441
$ cat CVE-2026-83548.txt
Description. SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-83549
SMA1000 Appliances
SonicWall SMA1000 Appliances OS Command Injection Vulnerability
due 2026-09-05 · CWE-78
$ cat CVE-2026-83549.txt
Description. SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-15409
SMA1000 Appliances [RANSOMWARE]
SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
due 2026-07-17 · CWE-918
$ cat CVE-2026-15409.txt
Description. SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-15410
SMA1000 Appliances [RANSOMWARE]
SonicWall SMA1000 Appliances Code Injection Vulnerability
due 2026-07-17 · CWE-94
$ cat CVE-2026-15410.txt
Description. SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2025-40602
SMA1000 appliance
SonicWall SMA1000 Missing Authorization Vulnerability
due 2025-12-24 · CWE-862 CWE-250
$ cat CVE-2025-40602.txt
Description. SonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console (AMC) of affected devices.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable
- CVE-2023-44221
SMA100 Appliances
SonicWall SMA100 Appliances OS Command Injection Vulnerability
due 2025-05-22 · CWE-78
$ cat CVE-2023-44221.txt
Description. SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2021-20035
SMA100 Appliances
SonicWall SMA100 Appliances OS Command Injection Vulnerability
due 2025-05-07 · CWE-78
$ cat CVE-2021-20035.txt
Description. SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2024-53704
SonicOS [RANSOMWARE]
SonicWall SonicOS SSLVPN Improper Authentication Vulnerability
due 2025-03-11 · CWE-287
$ cat CVE-2024-53704.txt
Description. SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2025-23006
SMA1000 Appliances [RANSOMWARE]
SonicWall SMA1000 Appliances Deserialization Vulnerability
due 2025-02-14 · CWE-502
$ cat CVE-2025-23006.txt
Description. SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-40766
SonicOS [RANSOMWARE]
SonicWall SonicOS Improper Access Control Vulnerability
due 2024-09-30 · CWE-284
$ cat CVE-2024-40766.txt
Description. SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2019-7483
SMA100
SonicWall SMA100 Directory Traversal Vulnerability
due 2022-04-18 · CWE-22
$ cat CVE-2019-7483.txt
Description. In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server.
Required action. Apply updates per vendor instructions.
- CVE-2021-20028
Secure Remote Access (SRA) [RANSOMWARE]
SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability
due 2022-04-18 · CWE-89
$ cat CVE-2021-20028.txt
Description. SonicWall Secure Remote Access (SRA) products contain an improper neutralization of a SQL Command leading to SQL injection.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2020-5135
SonicOS [RANSOMWARE]
SonicWall SonicOS Buffer Overflow Vulnerability
due 2022-04-05 · CWE-120
$ cat CVE-2020-5135.txt
Description. A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall.
Required action. Apply updates per vendor instructions.
- CVE-2021-20038
SMA 100 Appliances [RANSOMWARE]
SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability
due 2022-02-11 · CWE-121
$ cat CVE-2021-20038.txt
Description. SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution.
Required action. Apply updates per vendor instructions.
- CVE-2019-7481
SMA100 [RANSOMWARE]
SonicWall SMA100 SQL Injection Vulnerability
due 2022-05-03 · CWE-89
$ cat CVE-2019-7481.txt
Description. SonicWall SMA100 contains a SQL injection vulnerability allowing an unauthenticated user to gain read-only access to unauthorized resources.
Required action. Apply updates per vendor instructions.
- CVE-2021-20016
SSLVPN SMA100 [RANSOMWARE]
SonicWall SSLVPN SMA100 SQL Injection Vulnerability
due 2021-11-17 · CWE-89
$ cat CVE-2021-20016.txt
Description. SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker.
Required action. Apply updates per vendor instructions.
- CVE-2021-20021
SonicWall Email Security [RANSOMWARE]
SonicWall Email Security Improper Privilege Management Vulnerability
due 2021-11-17 · CWE-306
$ cat CVE-2021-20021.txt
Description. SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20022 and CVE-2021-20023 to achieve privilege escalation.
Required action. Apply updates per vendor instructions.
- CVE-2021-20022
SonicWall Email Security [RANSOMWARE]
SonicWall Email Security Unrestricted Upload of File Vulnerability
due 2021-11-17 · CWE-434
$ cat CVE-2021-20022.txt
Description. SonicWall Email Security contains an unrestricted upload of file with dangerous type vulnerability that allows a post-authenticated attacker to upload a file to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20023 to achieve privilege escalation.
Required action. Apply updates per vendor instructions.
- CVE-2021-20023
SonicWall Email Security [RANSOMWARE]
SonicWall Email Security Path Traversal Vulnerability
due 2021-11-17 · CWE-22
$ cat CVE-2021-20023.txt
Description. SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20022 to achieve privilege escalation.
Required action. Apply updates per vendor instructions.