CISA KEV + NVD
SonicWall flaws exploited in the wild
16 SonicWall vulnerabilities CISA lists as used by attackers, each with when it was published, NVD’s severity score, how many days passed between NVD publication and CISA’s KEV listing, and the vendor’s advisory where CISA links one. Catalog version 2026.10.20.
In numbers
- 16 exploited flaws, listed from 3 Nov 2021 to 2 Sep 2026
- 10 used in ransomware campaigns
- 9 scored critical by NVD
- 28 days: median gap between NVD publication and the KEV listing, leaving out the 2 listed on the catalog’s first day; 6 were listed within a week
All exploited SonicWall flaws, newest first
| Vulnerability | Product | Published | Added to KEV | CVSS | Advisory |
|---|---|---|---|---|---|
| CVE-2026-83549SonicWall SMA1000 Appliances OS Command Injection Vulnerability | SMA1000 Appliances | 1 Sep 2026 | 2 Sep 20261 day later | 7.8 High | Vendor |
| CVE-2026-83548SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability | SMA1000 Appliances | 1 Sep 2026 | 2 Sep 20261 day later | 10.0 Critical | Vendor |
| CVE-2026-15410SonicWall SMA1000 Appliances Code Injection Vulnerability | SMA1000 Appliances | 14 Jul 2026 | 14 Jul 2026same day or before NVDUsed in ransomware | 7.2 High | Vendor |
| CVE-2026-15409SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability | SMA1000 Appliances | 14 Jul 2026 | 14 Jul 2026same day or before NVDUsed in ransomware | 10.0 Critical | Vendor |
| CVE-2025-40602SonicWall SMA1000 Missing Authorization Vulnerability | SMA1000 appliance | 18 Dec 2025 | 17 Dec 2025same day or before NVD | 6.6 Medium | Vendor |
| CVE-2023-44221SonicWall SMA100 Appliances OS Command Injection Vulnerability | SMA100 Appliances | 5 Dec 2023 | 1 May 2025513 days later | 7.2 High | Vendor |
| CVE-2021-20035SonicWall SMA100 Appliances OS Command Injection Vulnerability | SMA100 Appliances | 27 Sep 2021 | 16 Apr 20251297 days later | 6.5 Medium | Vendor |
| CVE-2024-53704SonicWall SonicOS SSLVPN Improper Authentication Vulnerability | SonicOS | 9 Jan 2025 | 18 Feb 202540 days laterUsed in ransomware | 9.8 Critical | Vendor |
| CVE-2025-23006SonicWall SMA1000 Appliances Deserialization Vulnerability | SMA1000 Appliances | 23 Jan 2025 | 24 Jan 20251 day laterUsed in ransomware | 9.8 Critical | Vendor |
| CVE-2024-40766SonicWall SonicOS Improper Access Control Vulnerability | SonicOS | 23 Aug 2024 | 9 Sep 202417 days laterUsed in ransomware | 9.8 Critical | Vendor |
| CVE-2021-20028SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability | Secure Remote Access (SRA) | 4 Aug 2021 | 28 Mar 2022236 days laterUsed in ransomware | 9.8 Critical | — |
| CVE-2019-7483SonicWall SMA100 Directory Traversal Vulnerability | SMA100 | 19 Dec 2019 | 28 Mar 2022830 days later | 7.5 High | — |
| CVE-2020-5135SonicWall SonicOS Buffer Overflow Vulnerability | SonicOS | 12 Oct 2020 | 15 Mar 2022519 days laterUsed in ransomware | 9.8 Critical | — |
| CVE-2021-20038SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability | SMA 100 Appliances | 8 Dec 2021 | 28 Jan 202251 days laterUsed in ransomware | 9.8 Critical | — |
| CVE-2021-20016SonicWall SSLVPN SMA100 SQL Injection Vulnerability | SSLVPN SMA100 | 4 Feb 2021 | 3 Nov 2021272 days laterUsed in ransomware | 9.8 Critical | — |
| CVE-2019-7481SonicWall SMA100 SQL Injection Vulnerability | SMA100 | 17 Dec 2019 | 3 Nov 2021687 days laterUsed in ransomware | 7.5 High | — |
What to do
- Match the product and version on your appliance against the vendor advisory linked in the row (where none is shown, use the references on the NVD page), and install the fixed release it names.
- CISA’s required action is to apply the vendor’s updates or mitigations, or stop using the product where none exist; recent entries add CISA’s own hunt or forensic-triage steps, and end-of-life products are to be disconnected. US federal civilian agencies must act by a deadline; everyone else faces the same risk.
- Keep the management interface and the VPN portal off the public internet where you can, and restrict them to known addresses where you cannot.
- A patch does not remove an attacker who got in first. For any flaw on this list, look for the vendor’s or CISA’s guidance on signs of compromise, not just the fix.
How this list is kept
- A row appears when CISA adds the flaw to its Known Exploited Vulnerabilities catalog: attackers are using it, not just able to. The catalog is re-read every week.
- Scope is the perimeter appliance: firewalls, SSL-VPN and remote-access gateways, and the delivery controllers that terminate remote access. Email gateways, sandboxes, management consoles and endpoint tools from the same vendors are left out.
- Publication date and CVSS score are NVD’s. “Days later” counts from NVD publication to the KEV listing; “same day or before NVD” means CISA listed the flaw no later than NVD published it. The catalog began on 3 Nov 2021, so older flaws listed that day count to the catalog’s start, not to when exploitation was first reported; the medians leave them out.
- “Used in ransomware” is CISA’s own field, set when a ransomware campaign is known to have used the flaw. How the data pages are built.