Vendor
SonicWall
As of , 19 SonicWall vulnerabilities are on CISA's list of exploited vulnerabilities, 13 of them used in ransomware campaigns; 4 were added in 2026. Patch first: CVE-2026-83548.
Patch first
| # | Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|---|
| 1 | CVE-2026-83548Server-Side Request Forgery | SonicWall SMA1000 Appliances | Patch nowForensic triage required by CISA; Metasploit module | 0.09 | ||
| 2 | CVE-2026-83549OS Command Injection | SonicWall SMA1000 Appliances | Patch nowForensic triage required by CISA; Metasploit module | 0.11 | ||
| 3 | CVE-2026-15409Server-Side Request Forgery | SonicWall SMA1000 Appliances | Patch nowForensic triage required by CISA; ransomware use, listed within a year; Metasploit module | 0.07 | ||
| 4 | CVE-2026-15410Code Injection | SonicWall SMA1000 Appliances | Patch nowForensic triage required by CISA; ransomware use, listed within a year | 0.12 | ||
| 5 | CVE-2023-44221OS Command Injection | SonicWall SMA100 Appliances | Patch this weekEPSS 0.76 | 0.76 | ||
| 6 | CVE-2024-53704SSLVPN Improper Authentication | SonicWall SonicOS | Patch this weekRansomware use; EPSS 0.95 | 0.95 | ||
| 7 | CVE-2021-20038Stack-Based Buffer Overflow | SonicWall SMA 100 Appliances | Patch this weekRansomware use; EPSS 0.99 | 0.99 | ||
| 8 | CVE-2019-7481SQL Injection | SonicWall SMA100 | Patch this weekRansomware use; EPSS 0.99 | 0.99 | ||
| 9 | CVE-2021-20021Improper Privilege Management | SonicWall SonicWall Email Security | Patch this weekRansomware use; EPSS 0.89 | 0.89 | ||
| 10 | CVE-2021-20028SQL Injection | SonicWall Secure Remote Access (SRA) | Patch this weekRansomware use | 0.30 | ||
| 11 | CVE-2021-20016SQL Injection | SonicWall SSLVPN SMA100 | Patch this weekRansomware use | 0.40 | ||
| 12 | CVE-2021-20023Path Traversal | SonicWall SonicWall Email Security | Patch this weekRansomware use; EPSS 0.52 | 0.52 | ||
| 13 | CVE-2025-23006Deserialization | SonicWall SMA1000 Appliances | Patch this weekRansomware use | 0.23 | ||
| 14 | CVE-2024-40766Improper Access Control | SonicWall SonicOS | Patch this weekRansomware use | 0.18 | ||
| 15 | CVE-2020-5135Buffer Overflow | SonicWall SonicOS | Patch this weekRansomware use | 0.27 | ||
| 16 | CVE-2021-20022Unrestricted Upload of File | SonicWall SonicWall Email Security | Patch this weekRansomware use | 0.17 | ||
| 17 | CVE-2021-20035OS Command Injection | SonicWall SMA100 Appliances | Patch soon | 0.04 | ||
| 18 | CVE-2019-7483Directory Traversal | SonicWall SMA100 | Patch soon | 0.04 | ||
| 19 | CVE-2025-40602SMA1000 Missing Authorization | SonicWall SMA1000 appliance | Patch soon | 0.03 |
Products
- SMA1000 Appliances5 entries
- SonicOS3 entries
- SonicWall Email Security3 entries
- SMA1002 entries
- SMA100 Appliances2 entries
- Secure Remote Access (SRA)1 entry
- SMA 100 Appliances1 entry
- SMA1000 appliance1 entry
- SSLVPN SMA1001 entry
Added each year
Show the numbers
| Period | entries added |
|---|---|
| 2021 | 5 |
| 2022 | 4 |
| 2023 | none |
| 2024 | 1 |
| 2025 | 5 |
| 2026 | 4 |