SonicWall vendor intelligence

SonicWall Known Exploited Vulnerabilities

Track evidence-backed exploitation affecting SonicWall products, including the gap beyond CISA KEV, confidence assessments, sensor observations, and practical response context.

Browse SonicWall KEVs Full KEV feed

Total KEVs: 21; Known exploited vulnerabilities affecting SonicWall products
In CISA KEV: 17; Records also listed in the official catalog
Beyond CISA KEV: 4; Additional exploited CVEs absent from CISA KEV
Sensor Observed: 2; SonicWall KEVs with sensor-observed exploitation activity

The catalog gap matters for SonicWall exposure

Four of the 21 exploited SonicWall CVEs tracked here are not in CISA KEV. Teams relying on the official catalog alone would miss 19% of this vendor portfolio.

81%
Covered by CISA: 19%
Beyond CISA: 8
Product families

Attested SonicWall CVEs

Search the exploited-vulnerability portfolio, then narrow it to official CISA coverage or the additional records KEV Intelligence tracks beyond the catalog.

How exploitation is verified

CVE / description	Product	Confidence	CISA KEV	Added
CVE-2026-15410 Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management...	SMA1000	Confirmed	In CISA	14 Jul 2026
CVE-2026-15409 A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated...	SMA1000	Confirmed	In CISA	14 Jul 2026
CVE-2023-34133 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and Analytics allows an...	GMS, Analytics	High	Beyond CISA	07 Jul 2025
CVE-2025-40602 A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).	SMA1000	Confirmed	In CISA	01 Jun 2026
CVE-2023-44221 Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative...	SMA100	Confirmed	In CISA	01 May 2025
CVE-2018-9866 A vulnerability in lack of validation of user-supplied parameters pass to XML-RPC calls on SonicWall Global Management System (GMS) virtual...	Global Management System (GMS)	High	Beyond CISA	26 Apr 2025
CVE-2022-22274 A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to cause Denial of Service...	SonicOS	High	Beyond CISA	28 Apr 2025
CVE-2023-0656 A Stack-based buffer overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS), which could...	SonicOS	High	Beyond CISA	28 Apr 2025
CVE-2021-20016 A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access...	SonicWall SMA100	Confirmed	In CISA	03 Nov 2021
CVE-2021-20023 SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the...	Email Security	Confirmed	In CISA	03 Nov 2021
CVE-2021-20022 SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the...	Email Security	Confirmed	In CISA	03 Nov 2021
CVE-2019-7481 Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This vulnerablity impacted SMA100...	SMA100	Confirmed	In CISA	03 Nov 2021
CVE-2021-20021 A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP...	Email Security	Confirmed	In CISA	03 Nov 2021
CVE-2021-20038 A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated...	SonicWall SMA100	Confirmed	In CISA	28 Jan 2022
CVE-2020-5135 A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by...	SonicOS	Confirmed	In CISA	15 Mar 2022
CVE-2019-7483 In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of...	SMA100	Confirmed	In CISA	28 Mar 2022
CVE-2021-20028 Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products,...	SonicWall SRA/SMA100	Confirmed	In CISA	28 Mar 2022
CVE-2024-40766 An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized...	SonicOS	Confirmed	In CISA	09 Sep 2024
CVE-2025-23006 Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and...	SMA1000	Confirmed	In CISA	24 Jan 2025
CVE-2024-53704 An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.	SonicOS	Confirmed	In CISA	18 Feb 2025
CVE-2021-20035 Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands...	SMA100	Confirmed	In CISA	16 Apr 2025

Showing 21 of 21 SonicWall known exploited vulnerabilities.

Recurring weakness patterns

Neutralization, stack-based buffer overflow, and neutralization account for nine mapped occurrences across this SonicWall KEV portfolio.

Browse all KEVs →

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CWE-121

Stack-based Buffer Overflow

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-287

Improper Authentication

CWE-434

Unrestricted Upload of File with Dangerous Type

CWE-502

Deserialization of Untrusted Data

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Early warning alerts

Get alerts on high-impact exploitation

Receive curator-selected alerts when exploitation activity warrants attention. Each alert includes the evidence and context needed to decide what requires attention now.