{"meta":{"title":"KEV entries: SonicWall","description":"All KEV entries for vendor SonicWall.","source":"CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)","catalogVersion":"2026.09.23","catalogDateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","publisher":"Telemetry","license":"https://creativecommons.org/licenses/by/4.0/","documentation":"https://glide-telemetry.pages.dev/api/","records":19,"vendor":"SonicWall","entries":19,"shareOfCatalogPercent":1.1,"ransomwareKnown":13,"firstDateAdded":"2021-11-03","latestDateAdded":"2026-09-02","rank":14},"data":[{"cveID":"CVE-2026-83549","vendorProject":"SonicWall","product":"SMA1000 Appliances","vulnerabilityName":"SonicWall SMA1000 Appliances OS Command Injection Vulnerability","dateAdded":"2026-09-02","dueDate":"2026-09-05","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83549","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-83549/"},{"cveID":"CVE-2026-83548","vendorProject":"SonicWall","product":"SMA1000 Appliances","vulnerabilityName":"SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability","dateAdded":"2026-09-02","dueDate":"2026-09-05","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-918","CWE-441"],"shortDescription":"SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-83548","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-83548/"},{"cveID":"CVE-2026-15410","vendorProject":"SonicWall","product":"SMA1000 Appliances","vulnerabilityName":"SonicWall SMA1000 Appliances Code Injection Vulnerability","dateAdded":"2026-07-14","dueDate":"2026-07-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-94"],"shortDescription":"SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-15410","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-15410/"},{"cveID":"CVE-2026-15409","vendorProject":"SonicWall","product":"SMA1000 Appliances","vulnerabilityName":"SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability","dateAdded":"2026-07-14","dueDate":"2026-07-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-918"],"shortDescription":"SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-15409","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-15409/"},{"cveID":"CVE-2025-40602","vendorProject":"SonicWall","product":"SMA1000 appliance","vulnerabilityName":"SonicWall SMA1000 Missing Authorization Vulnerability","dateAdded":"2025-12-17","dueDate":"2025-12-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-862","CWE-250"],"shortDescription":"SonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console (AMC) of affected devices.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable","notes":"Check for signs of potential compromise on all internet accessible SonicWall SMA1000 instances after applying mitigations. For more information please see: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0019 ; https://nvd.nist.gov/vuln/detail/CVE-2025-40602","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-40602"},{"cveID":"CVE-2023-44221","vendorProject":"SonicWall","product":"SMA100 Appliances","vulnerabilityName":"SonicWall SMA100 Appliances OS Command Injection Vulnerability","dateAdded":"2025-05-01","dueDate":"2025-05-22","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0018 ; https://nvd.nist.gov/vuln/detail/CVE-2023-44221","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2023-44221"},{"cveID":"CVE-2021-20035","vendorProject":"SonicWall","product":"SMA100 Appliances","vulnerabilityName":"SonicWall SMA100 Appliances OS Command Injection Vulnerability","dateAdded":"2025-04-16","dueDate":"2025-05-07","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0022 ; https://nvd.nist.gov/vuln/detail/CVE-2021-20035","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2021-20035"},{"cveID":"CVE-2024-53704","vendorProject":"SonicWall","product":"SonicOS","vulnerabilityName":"SonicWall SonicOS SSLVPN Improper Authentication Vulnerability","dateAdded":"2025-02-18","dueDate":"2025-03-11","knownRansomwareCampaignUse":"Known","cwes":["CWE-287"],"shortDescription":"SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0003 ; https://nvd.nist.gov/vuln/detail/CVE-2024-53704","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2024-53704"},{"cveID":"CVE-2025-23006","vendorProject":"SonicWall","product":"SMA1000 Appliances","vulnerabilityName":"SonicWall SMA1000 Appliances Deserialization Vulnerability","dateAdded":"2025-01-24","dueDate":"2025-02-14","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0002 ; https://nvd.nist.gov/vuln/detail/CVE-2025-23006","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-23006"},{"cveID":"CVE-2024-40766","vendorProject":"SonicWall","product":"SonicOS","vulnerabilityName":"SonicWall SonicOS Improper Access Control Vulnerability","dateAdded":"2024-09-09","dueDate":"2024-09-30","knownRansomwareCampaignUse":"Known","cwes":["CWE-284"],"shortDescription":"SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015; https://www.sonicwall.com/support/notices/gen-7-and-newer-sonicwall-firewalls-sslvpn-recent-threat-activity/kA1VN0000000RDG0A2 ; https://nvd.nist.gov/vuln/detail/CVE-2024-40766","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-40766"},{"cveID":"CVE-2021-20028","vendorProject":"SonicWall","product":"Secure Remote Access (SRA)","vulnerabilityName":"SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Known","cwes":["CWE-89"],"shortDescription":"SonicWall Secure Remote Access (SRA) products contain an improper neutralization of a SQL Command leading to SQL injection.","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-20028","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-20028"},{"cveID":"CVE-2019-7483","vendorProject":"SonicWall","product":"SMA100","vulnerabilityName":"SonicWall SMA100 Directory Traversal Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-22"],"shortDescription":"In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-7483","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-7483"},{"cveID":"CVE-2020-5135","vendorProject":"SonicWall","product":"SonicOS","vulnerabilityName":"SonicWall SonicOS Buffer Overflow Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-120"],"shortDescription":"A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-5135","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2020-5135"},{"cveID":"CVE-2021-20038","vendorProject":"SonicWall","product":"SMA 100 Appliances","vulnerabilityName":"SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability","dateAdded":"2022-01-28","dueDate":"2022-02-11","knownRansomwareCampaignUse":"Known","cwes":["CWE-121"],"shortDescription":"SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-20038","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-20038"},{"cveID":"CVE-2021-20023","vendorProject":"SonicWall","product":"SonicWall Email Security","vulnerabilityName":"SonicWall Email Security Path Traversal Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20022 to achieve privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-20023","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-20023"},{"cveID":"CVE-2021-20022","vendorProject":"SonicWall","product":"SonicWall Email Security","vulnerabilityName":"SonicWall Email Security Unrestricted Upload of File Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-434"],"shortDescription":"SonicWall Email Security contains an unrestricted upload of file with dangerous type vulnerability that allows a post-authenticated attacker to upload a file to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20023 to achieve privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-20022","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-20022"},{"cveID":"CVE-2021-20021","vendorProject":"SonicWall","product":"SonicWall Email Security","vulnerabilityName":"SonicWall Email Security Improper Privilege Management Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-306"],"shortDescription":"SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20022 and CVE-2021-20023 to achieve privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-20021","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-20021"},{"cveID":"CVE-2021-20016","vendorProject":"SonicWall","product":"SSLVPN SMA100","vulnerabilityName":"SonicWall SSLVPN SMA100 SQL Injection Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-89"],"shortDescription":"SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-20016","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-20016"},{"cveID":"CVE-2019-7481","vendorProject":"SonicWall","product":"SMA100","vulnerabilityName":"SonicWall SMA100 SQL Injection Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-89"],"shortDescription":"SonicWall SMA100 contains a SQL injection vulnerability allowing an unauthenticated user to gain read-only access to unauthorized resources.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-7481","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-7481"}]}