SonicWall known exploited vulnerabilities
Every SonicWall CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 20 in all, 6 added in the last 12 months.
- CVE-2026-19868An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate…SonicWall SonicOS
- CVE-2026-83549Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identiSonicWall SMA1000
- CVE-2026-83548A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path.SonicWall SMA1000
- CVE-2026-15410Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance ManSonicWall SMA1000
- CVE-2026-15409A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface.SonicWall SMA1000
- CVE-2025-40602A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).SonicWall SMA1000
- CVE-2023-44221Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrSonicWall SMA100
- CVE-2021-20035Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary coSonicWall SMA100
- CVE-2024-53704An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.SonicWall SonicOS
- CVE-2025-23006Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) andSonicWall SMA1000
- CVE-2024-40766An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorizedSonicWall SonicOS
- CVE-2021-20028Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, sSonicWall SRA/SMA100
- CVE-2019-7483In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the preseSonicWall SMA100
- CVE-2020-5135A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code SonicWall SonicOS
- CVE-2021-20038A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticSonicWall SMA100
- CVE-2021-20023SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on thSonicWall Email Security
- CVE-2021-20022SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to SonicWall Email Security
- CVE-2021-20021A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a craftedSonicWall Email Security
- CVE-2021-20016A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to accessSonicWall SMA100
- CVE-2019-7481Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources.SonicWall SMA100
Get alerts for new known exploited vulnerabilities
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/kev/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/kev/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/kev/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/kev/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
https://cve.now/api/v1/entries?filter=kev
Pages of 30 entries, newest first. Pass the response's nextCursor as cursor for the next page.
Frequently asked questions
How many SonicWall vulnerabilities are in CISA KEV?
20 SonicWall vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog, 6 of them added in the last 12 months. The newest is CVE-2026-19868 (SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability), added 2026-11-06.
Which SonicWall products are in CISA KEV?
10 products, including SonicOS SSLVPN, SMA1000 Appliances, SMA1000 appliance. Attackers have exploited every one of these entries in the wild, and US federal agencies must patch each by its CISA due date.
Are SonicWall KEV vulnerabilities used by ransomware?
CISA knows ransomware campaigns exploit 13 of the 20 SonicWall entries.