SonicWall vulnerabilities
221 CVEs and advisories name SonicWall as an affected vendor, 20 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-19703A weak password hashing vulnerability has been identified on SonicOS virtual appliances, which in specific conditions could potentially…
- CVE-2026-77709A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in…
- CVE-2026-77708A pre-authentication stack-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in…
- CVE-2026-19868An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate…
- CVE-2026-82308A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS SSL-VPN service, which could potentially…
- CVE-2026-107154A session validation vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially…
- CVE-2026-107155A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could…
- CVE-2026-109594Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has been identified…
- CVE-2026-109593An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files…
- CVE-2026-100232Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identi
- CVE-2026-96540An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, pot
- CVE-2026-102258Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) wh
- CVE-2026-102257A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the
- CVE-2026-102256Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identi
- CVE-2026-102255A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path.
- CVE-2026-81939A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an
- CVE-2026-78328A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged
- CVE-2026-78327An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Securit
- CVE-2026-83549Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identi
- CVE-2026-83548A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path.
- CVE-2026-66153The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to mani
- CVE-2026-66152A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file
- CVE-2026-66150Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated at
- CVE-2026-66149Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated at
- CVE-2026-18634An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and
- CVE-2026-66154An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) a
- CVE-2026-66148An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier vers
- CVE-2026-66147An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allo
- CVE-2026-66146Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote
- CVE-2026-66145An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remot