Cyberfeed6 › Vendors › SonicWall
CISA lists 19 SonicWall vulnerabilities as exploited in real attacks, and 13 of them are known to be used in ransomware campaigns. Most entries concern SMA1000 Appliances, SonicOS, SonicWall Email Security, SMA100 Appliances.
Showing the 19 most recently added of 19. Check the vendor notice before you act: it names the fixed versions.
| Vulnerability | Product | Added to list | Severity | Ransomware | Fix |
|---|---|---|---|---|---|
| CVE-2026-83549SonicWall SMA1000 Appliances OS Command Injection Vulnerability | SMA1000 Appliances | 2026-09-02 | High (7.8) | No | Vendor notice |
| CVE-2026-83548SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability | SMA1000 Appliances | 2026-09-02 | Critical (10.0) | No | Vendor notice |
| CVE-2026-15410SonicWall SMA1000 Appliances Code Injection Vulnerability | SMA1000 Appliances | 2026-07-14 | High (7.2) | Yes | Vendor notice |
| CVE-2026-15409SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability | SMA1000 Appliances | 2026-07-14 | Critical (10.0) | Yes | Vendor notice |
| CVE-2025-40602SonicWall SMA1000 Missing Authorization Vulnerability | SMA1000 appliance | 2025-12-17 | Medium (6.6) | No | Vendor notice |
| CVE-2023-44221SonicWall SMA100 Appliances OS Command Injection Vulnerability | SMA100 Appliances | 2025-05-01 | High (7.2) | No | Vendor notice |
| CVE-2021-20035SonicWall SMA100 Appliances OS Command Injection Vulnerability | SMA100 Appliances | 2025-04-16 | Medium (6.5) | No | Vendor notice |
| CVE-2024-53704SonicWall SonicOS SSLVPN Improper Authentication Vulnerability | SonicOS | 2025-02-18 | High (8.2) | Yes | Vendor notice |
| CVE-2025-23006SonicWall SMA1000 Appliances Deserialization Vulnerability | SMA1000 Appliances | 2025-01-24 | Critical (9.8) | Yes | Vendor notice |
| CVE-2024-40766SonicWall SonicOS Improper Access Control Vulnerability | SonicOS | 2024-09-09 | Critical (9.3) | Yes | Vendor notice |
| CVE-2021-20028SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability | Secure Remote Access (SRA) | 2022-03-28 | Critical (9.8) | Yes | |
| CVE-2019-7483SonicWall SMA100 Directory Traversal Vulnerability | SMA100 | 2022-03-28 | High (7.5) | No | |
| CVE-2020-5135SonicWall SonicOS Buffer Overflow Vulnerability | SonicOS | 2022-03-15 | Critical (9.8) | Yes | |
| CVE-2021-20038SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability | SMA 100 Appliances | 2022-01-28 | Critical (9.8) | Yes | |
| CVE-2021-20023SonicWall Email Security Path Traversal Vulnerability | SonicWall Email Security | 2021-11-03 | Medium (4.9) | Yes | |
| CVE-2021-20022SonicWall Email Security Unrestricted Upload of File Vulnerability | SonicWall Email Security | 2021-11-03 | High (7.2) | Yes | |
| CVE-2021-20021SonicWall Email Security Improper Privilege Management Vulnerability | SonicWall Email Security | 2021-11-03 | Critical (9.8) | Yes | |
| CVE-2021-20016SonicWall SSLVPN SMA100 SQL Injection Vulnerability | SSLVPN SMA100 | 2021-11-03 | Critical (9.8) | Yes | |
| CVE-2019-7481SonicWall SMA100 SQL Injection Vulnerability | SMA100 | 2021-11-03 | High (7.5) | Yes |
Source: CISA Known Exploited Vulnerabilities catalog, released 2026-11-04. Severity scores are CVSS where available. "Ransomware" means CISA has marked the flaw as known to be used in ransomware campaigns.