By year
01
02
03
05
07
08
10
12
13
14
15
16
18
19
20
21
22
23
24
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Exploited SonicWall flaws
These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.
- CVE-2026-83548 SonicWall SMA1000 Appliances Server-Side Request ForgeryExploited since Sep 2, 2026 · CVSS 10
- CVE-2026-83549 SonicWall SMA1000 Appliances OS Command InjectionExploited since Sep 2, 2026 · CVSS 7.8
- CVE-2026-15410 SonicWall SMA1000 Appliances Code InjectionExploited since Jul 14, 2026 · ransomware · CVSS 7.2
- CVE-2026-15409 SonicWall SMA1000 Appliances Server-Side Request ForgeryExploited since Jul 14, 2026 · ransomware · CVSS 10
- CVE-2025-40602 SonicWall SMA1000 Missing AuthorizationExploited since Dec 17, 2025 · CVSS 6.6
- CVE-2023-44221 SonicWall SMA100 Appliances OS Command InjectionExploited since May 1, 2025 · CVSS 7.2
- CVE-2021-20035 SonicWall SMA100 Appliances OS Command InjectionExploited since Apr 16, 2025 · CVSS 6.5
- CVE-2024-53704 SonicWall SonicOS SSLVPN Improper AuthenticationExploited since Feb 18, 2025 · ransomware · CVSS 9.8
- CVE-2025-23006 SonicWall SMA1000 Appliances DeserializationExploited since Jan 24, 2025 · ransomware · CVSS 9.8
- CVE-2024-40766 SonicWall SonicOS Improper Access ControlExploited since Sep 9, 2024 · ransomware · CVSS 9.8
- CVE-2019-7483 SonicWall SMA100 Directory TraversalExploited since Mar 28, 2022 · CVSS 7.5
- CVE-2021-20028 SonicWall Secure Remote Access (SRA) SQL InjectionExploited since Mar 28, 2022 · ransomware · CVSS 9.8
- CVE-2020-5135 SonicWall SonicOS Buffer OverflowExploited since Mar 15, 2022 · ransomware · CVSS 9.8
- CVE-2021-20038 SonicWall SMA 100 Appliances Stack-Based Buffer OverflowExploited since Jan 28, 2022 · ransomware · CVSS 9.8
- CVE-2021-20021 SonicWall Email Security Improper Privilege ManagementExploited since Nov 3, 2021 · ransomware · CVSS 9.8
- CVE-2021-20016 SonicWall SSLVPN SMA100 SQL InjectionExploited since Nov 3, 2021 · ransomware · CVSS 9.8
- CVE-2021-20022 SonicWall Email Security Unrestricted Upload of FileExploited since Nov 3, 2021 · ransomware · CVSS 7.2
- CVE-2021-20023 SonicWall Email Security Path TraversalExploited since Nov 3, 2021 · ransomware · CVSS 4.9
- CVE-2019-7481 SonicWall SMA100 SQL InjectionExploited since Nov 3, 2021 · ransomware · CVSS 7.5
Latest high and critical flaws
- CVE-2026-96540 An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially allowing a High 8.8 · Oct 14, 2026
- CVE-2026-100232 Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWalHigh 7.2 · Oct 14, 2026
- CVE-2026-102257 A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the intended destinationHigh 7.2 · Oct 7, 2026
- CVE-2026-102256 Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 High 7.8 · Oct 7, 2026
- CVE-2026-102255 A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path.Critical 10 · Oct 7, 2026
- CVE-2026-81939 A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract Critical 9.1 · Sep 4, 2026
- CVE-2026-78328 A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalCritical 9.1 · Sep 4, 2026
- CVE-2026-78327 An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Security Manager (NSM) On-PCritical 9.1 · Sep 4, 2026
- CVE-2026-83549 SonicWall SMA1000 Appliances OS Command InjectionExploited · High 7.8 · Sep 1, 2026
- CVE-2026-83548 SonicWall SMA1000 Appliances Server-Side Request ForgeryExploited · Critical 10 · Sep 1, 2026
- CVE-2026-66153 The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths.High 7 · Aug 25, 2026
- CVE-2026-66152 A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root.High 8.8 · Aug 25, 2026
- CVE-2026-66154 An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions High 8.3 · Aug 11, 2026
- CVE-2026-66150 Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access tHigh 7.8 · Aug 11, 2026
- CVE-2026-66149 Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access tHigh 7.8 · Aug 11, 2026
- CVE-2026-66147 An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker tCritical 9.4 · Aug 11, 2026
- CVE-2026-18634 An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions.High 8.4 · Aug 11, 2026
- CVE-2026-66145 An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read sCritical 9.1 · Aug 11, 2026
- CVE-2026-15410 SonicWall SMA1000 Appliances Code InjectionExploited · High 7.2 · Jul 14, 2026
- CVE-2026-15409 SonicWall SMA1000 Appliances Server-Side Request ForgeryExploited · Critical 10 · Jul 14, 2026
- CVE-2026-0204 A vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be accessible under specific conditions.High 8 · Apr 29, 2026
- CVE-2026-4116 Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/Connect Tunnel TOTP aHigh 7.2 · Apr 9, 2026
- CVE-2026-4113 An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN user credentials.High 7.2 · Apr 9, 2026
- CVE-2026-4112 Improper neutralization of special elements used in an SQL command (“SQL Injection”) in SonicWall SMA1000 series appliances allows a remote authenticated attackHigh 7.2 · Apr 9, 2026
- CVE-2025-40604 Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, alloCritical 9.8 · Nov 20, 2025
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.