Vulnerabilities by vendor · updated on every deploy
SonicWall vulnerabilities: exploited CVEs and our analysis
SonicWall has 19 vulnerabilities in CISA's Known Exploited Vulnerabilities catalog, 5 of them added in the last 12 months and 13 known to be used in ransomware campaigns. Below: the 2 analyses Zero Hunt Research published on SonicWall products, then the catalog entries newest first with the federal due date.
CISA catalog version 2026.10.21, released 2026-10-21 14:04 UTC.
19
CVEs in CISA KEV
5
Added in the last 12 months
13
Known ransomware use
2
Zero Hunt analyses
Products with the most KEV entries: SMA1000 Appliances (5) · SonicOS (3) · SonicWall Email Security (3) · SMA100 (2) · SMA100 Appliances (2) · Secure Remote Access (SRA) (1)
Our analysis of SonicWall vulnerabilities
2026-10-07
SonicWall SMA 1000 CVE-2026-102255: Max-Severity Pre-Auth SSRFSonicWall patched CVE-2026-102255, a CVSS 10 pre-auth SSRF in SMA 1000 Work Place. No exploitation yet — but the same appliance was rooted in July.
2026-07-16
SonicWall SMA1000 Zero-Days: CVE-2026-15409 Chains SSRF to RootSonicWall SMA1000 is under active attack: unauth SSRF CVE-2026-15409 chains with CVE-2026-15410 to reach root — patch to 12.4.3-03453 / 12.5.0-02835, then hunt and rotate.
All 19 KEV entries
| Added | CVE | Product and vulnerability | Federal due date | Flags | Our analysis |
|---|---|---|---|---|---|
| 2026-09-02 | CVE-2026-83549 | SMA1000 Appliances SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution. | 2026-09-05 | Forensic triage | — |
| 2026-09-02 | CVE-2026-83548 | SMA1000 Appliances SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized oper… | 2026-09-05 | Forensic triage | — |
| 2026-07-14 | CVE-2026-15410 | SMA1000 Appliances SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands. | 2026-07-17 | RansomwareForensic triage | — |
| 2026-07-14 | CVE-2026-15409 | SMA1000 Appliances SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location. | 2026-07-17 | RansomwareForensic triage | Read → |
| 2025-12-17 | CVE-2025-40602 | SMA1000 appliance SonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console (AMC) of affected devices. | 2025-12-24 | — | |
| 2025-05-01 | CVE-2023-44221 | SMA100 Appliances SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as… | 2025-05-22 | — | |
| 2025-04-16 | CVE-2021-20035 | SMA100 Appliances SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentiall… | 2025-05-07 | — | |
| 2025-02-18 | CVE-2024-53704 | SonicOS SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication. | 2025-03-11 | Ransomware | — |
| 2025-01-24 | CVE-2025-23006 | SMA1000 Appliances SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbit… | 2025-02-14 | Ransomware | — |
| 2024-09-09 | CVE-2024-40766 | SonicOS SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash. | 2024-09-30 | Ransomware | — |
| 2022-03-28 | CVE-2021-20028 | Secure Remote Access (SRA) SonicWall Secure Remote Access (SRA) products contain an improper neutralization of a SQL Command leading to SQL injection. | 2022-04-18 | Ransomware | — |
| 2022-03-28 | CVE-2019-7483 | SMA100 In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server. | 2022-04-18 | — | |
| 2022-03-15 | CVE-2020-5135 | SonicOS A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. | 2022-04-05 | Ransomware | — |
| 2022-01-28 | CVE-2021-20038 | SMA 100 Appliances SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution. | 2022-02-11 | Ransomware | — |
| 2021-11-03 | CVE-2021-20023 | SonicWall Email Security SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit cha… | 2021-11-17 | Ransomware | — |
| 2021-11-03 | CVE-2021-20022 | SonicWall Email Security SonicWall Email Security contains an unrestricted upload of file with dangerous type vulnerability that allows a post-authenticated attacker to upload a file to the remote host. This vulnerability has known usage in a… | 2021-11-17 | Ransomware | — |
| 2021-11-03 | CVE-2021-20021 | SonicWall Email Security SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This vulnerability has… | 2021-11-17 | Ransomware | — |
| 2021-11-03 | CVE-2021-20016 | SSLVPN SMA100 SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker. | 2021-11-17 | Ransomware | — |
| 2021-11-03 | CVE-2019-7481 | SMA100 SonicWall SMA100 contains a SQL injection vulnerability allowing an unauthenticated user to gain read-only access to unauthorized resources. | 2022-05-03 | Ransomware | — |
Source: CISA Known Exploited Vulnerabilities catalog (public data). Descriptions are CISA's, shortened. Always check the vendor advisory before acting. cisa.gov
Before you patch: three checks
- 01Match the exact version and configuration you run against the vendor advisory. Owning the product is not the same as being exposed.
- 02Check reachability: an exploited flaw on an interface reachable from the internet, or from a compromised workstation, moves to the front of the queue.
- 03Where CISA flags forensic triage, hunt for compromise as well as patch: a fix does not remove an attacker who got in before it.
Questions
How many SonicWall vulnerabilities are in the CISA KEV catalog?
19 in catalog version 2026.10.21, the first added on 2021-11-03 and the most recent on 2026-09-02. 5 were added in the last 12 months.
Which SonicWall products have the most exploited vulnerabilities?
By KEV entries: SMA1000 Appliances (5), SonicOS (3), SonicWall Email Security (3), SMA100 (2), SMA100 Appliances (2), Secure Remote Access (SRA) (1).
Are SonicWall vulnerabilities used in ransomware attacks?
CISA marks 13 of the 19 SonicWall entries as known to be used in ransomware campaigns. The table flags them.
Is the next SonicWall CVE exploitable on your network?
A KEV entry says a vulnerability is exploited somewhere. Zero Hunt answers whether it is exploitable in your environment: an autonomous AI red team on an on-premise appliance, running on private AI, black-box or gray-box, with a human approving every step that matters.
Other vendors: Cisco · Microsoft · Fortinet · Linux kernel · Citrix · GitLab · Adobe · Palo Alto Networks · Check Point · Langflow · Arista · Oracle · Ivanti · VMware · Zimbra · SAP · Atlassian · Zyxel · Progress · F5