SonicWall flaws being used in attacks
CISA lists 19 flaws in SonicWall products as being used in attacks, most recently on 2 Sep 2026. 13 have been used in ransomware.
SonicWallBeing used in attacks
- On CISA’s list
- 19 flaws, added between 3 Nov 2021 and 2 Sep 2026
- Most recent
- CVE-2026-83549, SonicWall SMA1000 Appliances OS Command Injection Vulnerability, added 2 Sep 2026
- Used in ransomware
- 13 flaws, according to CISA
- Products
- SMA1000 Appliances (5), SonicOS (3), SonicWall Email Security (3), SMA100 (2), SMA100 Appliances (2), and 4 more
What to do
- Update every SonicWall product you use.Install the updates SonicWall offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
- If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
- Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.
Every flaw, newest first
- SonicWall SMA1000 Appliances
CVE-2026-83549SonicWall SMA1000 Appliances OS Command Injection VulnerabilitySonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - SonicWall SMA1000 Appliances
CVE-2026-83548SonicWall SMA1000 Appliances Server-Side Request Forgery VulnerabilitySonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - SonicWall SMA1000 Appliances
CVE-2026-15410SonicWall SMA1000 Appliances Code Injection VulnerabilitySonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - SonicWall SMA1000 Appliances
CVE-2026-15409SonicWall SMA1000 Appliances Server-Side Request Forgery VulnerabilitySonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - SonicWall SMA1000 appliance
CVE-2025-40602SonicWall SMA1000 Missing Authorization VulnerabilitySonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console (AMC) of affected devices.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable - SonicWall SMA100 Appliances
CVE-2023-44221SonicWall SMA100 Appliances OS Command Injection VulnerabilitySonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - SonicWall SMA100 Appliances
CVE-2021-20035SonicWall SMA100 Appliances OS Command Injection VulnerabilitySonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - SonicWall SonicOS
CVE-2024-53704SonicWall SonicOS SSLVPN Improper Authentication VulnerabilitySonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - SonicWall SMA1000 Appliances
CVE-2025-23006SonicWall SMA1000 Appliances Deserialization VulnerabilitySonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - SonicWall SonicOS
CVE-2024-40766SonicWall SonicOS Improper Access Control VulnerabilitySonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - SonicWall Secure Remote Access (SRA)
CVE-2021-20028SonicWall Secure Remote Access (SRA) SQL Injection VulnerabilitySonicWall Secure Remote Access (SRA) products contain an improper neutralization of a SQL Command leading to SQL injection.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - SonicWall SMA100
CVE-2019-7483SonicWall SMA100 Directory Traversal VulnerabilityIn SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server.CISA’s required actionApply updates per vendor instructions. - SonicWall SonicOS
CVE-2020-5135SonicWall SonicOS Buffer Overflow VulnerabilityA buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall.CISA’s required actionApply updates per vendor instructions. - SonicWall SMA 100 Appliances
CVE-2021-20038SonicWall SMA 100 Appliances Stack-Based Buffer Overflow VulnerabilitySonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution.CISA’s required actionApply updates per vendor instructions. - SonicWall Email Security
CVE-2021-20023SonicWall Email Security Path Traversal VulnerabilitySonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20022 to achieve privilege escalation.CISA’s required actionApply updates per vendor instructions. - SonicWall Email Security
CVE-2021-20022SonicWall Email Security Unrestricted Upload of File VulnerabilitySonicWall Email Security contains an unrestricted upload of file with dangerous type vulnerability that allows a post-authenticated attacker to upload a file to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20023 to achieve privilege escalation.CISA’s required actionApply updates per vendor instructions. - SonicWall Email Security
CVE-2021-20021SonicWall Email Security Improper Privilege Management VulnerabilitySonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20022 and CVE-2021-20023 to achieve privilege escalation.CISA’s required actionApply updates per vendor instructions. - SonicWall SSLVPN SMA100
CVE-2021-20016SonicWall SSLVPN SMA100 SQL Injection VulnerabilitySonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker.CISA’s required actionApply updates per vendor instructions. - SonicWall SMA100
CVE-2019-7481SonicWall SMA100 SQL Injection VulnerabilitySonicWall SMA100 contains a SQL injection vulnerability allowing an unauthenticated user to gain read-only access to unauthorized resources.CISA’s required actionApply updates per vendor instructions.
From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. SonicWall on CISA’s site.