Live monitoring Updated 72-hour alert levelMajor alert Editor: Frédéric LENQUETTE
CYBERIACKCybersecurity & AI intelligence · by Frédéric LENQUETTE

Vendor

SonicWall: actively exploited vulnerabilities

19 vulnerabilities in SonicWall products are listed in CISA’s catalog of actively exploited vulnerabilities, 13 of them used by ransomware. Latest addition on September 2, 2026: CVE-2026-83549 (SMA1000 Appliances).

Affected products

  • SMA1000 Appliances5
  • SonicOS3
  • SonicWall Email Security3
  • SMA1002
  • SMA100 Appliances2
  • Secure Remote Access (SRA)1
  • SMA 100 Appliances1
  • SMA1000 appliance1
  • SSLVPN SMA1001

Our analyses

CERT-FR alerts and notices

Recent CERT-FR publications naming this vendor (alerts: immediate threat; notices: patches released). In French.

  1. CERTFR-2026-AVI-1275

    Multiples vulnérabilités dans Sonicwall Secure Mobile Access (07 octobre 2026)

  2. CERTFR-2026-ALE-009

    Multiples vulnérabilités dans SonicWall Secure Mobile Access (02 septembre 2026)

  3. CERTFR-2026-ALE-006

    Multiples vulnérabilités dans Sonicwall Secure Mobile Access (15 juillet 2026)

  4. CERTFR-2025-ALE-011

    Incidents de sécurité dans les pare-feux SonicWall (05 août 2025)

  5. CERTFR-2024-ALE-011

    Vulnérabilité dans SonicWall (10 septembre 2024)

All exploited vulnerabilities

CISA KEV catalog, newest first: each entry corresponds to observed exploitation.

2026 4 vulnerabilities

  1. CVE-2026-83549

    SonicWall SMA1000 Appliances OS Command Injection Vulnerability

    NVD entryCISA catalog

  2. CVE-2026-83548

    SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

    Mentioned in our article: SonicWall SMA1000: critical flaw CVE-2026-102255 already targeted in attacks

    NVD entryCISA catalog

  3. CVE-2026-15410Used by ransomware

    SonicWall SMA1000 Appliances Code Injection Vulnerability

    NVD entryCISA catalog

  4. CVE-2026-15409Used by ransomware

    SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

    Mentioned in our article: SonicWall SMA1000: critical flaw CVE-2026-102255 already targeted in attacks

    NVD entryCISA catalog

2025 5 vulnerabilities

  1. CVE-2025-40602

    SonicWall SMA1000 Missing Authorization Vulnerability

    NVD entryCISA catalog

  2. CVE-2023-44221

    SonicWall SMA100 Appliances OS Command Injection Vulnerability

    NVD entryCISA catalog

  3. CVE-2021-20035

    SonicWall SMA100 Appliances OS Command Injection Vulnerability

    NVD entryCISA catalog

  4. CVE-2024-53704Used by ransomware

    SonicWall SonicOS SSLVPN Improper Authentication Vulnerability

    NVD entryCISA catalog

  5. CVE-2025-23006Used by ransomware

    SonicWall SMA1000 Appliances Deserialization Vulnerability

    NVD entryCISA catalog

2024 1 vulnerability

  1. CVE-2024-40766Used by ransomware

    SonicWall SonicOS Improper Access Control Vulnerability

    NVD entryCISA catalog

2022 4 vulnerabilities

  1. CVE-2021-20028Used by ransomware

    SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability

    NVD entryCISA catalog

  2. CVE-2019-7483

    SonicWall SMA100 Directory Traversal Vulnerability

    NVD entryCISA catalog

  3. CVE-2020-5135Used by ransomware

    SonicWall SonicOS Buffer Overflow Vulnerability

    NVD entryCISA catalog

  4. CVE-2021-20038Used by ransomware

    SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability

    NVD entryCISA catalog

2021 5 vulnerabilities

  1. CVE-2021-20023Used by ransomware

    SonicWall Email Security Path Traversal Vulnerability

    NVD entryCISA catalog

  2. CVE-2021-20022Used by ransomware

    SonicWall Email Security Unrestricted Upload of File Vulnerability

    NVD entryCISA catalog

  3. CVE-2021-20021Used by ransomware

    SonicWall Email Security Improper Privilege Management Vulnerability

    NVD entryCISA catalog

  4. CVE-2021-20016Used by ransomware

    SonicWall SSLVPN SMA100 SQL Injection Vulnerability

    NVD entryCISA catalog

  5. CVE-2019-7481Used by ransomware

    SonicWall SMA100 SQL Injection Vulnerability

    NVD entryCISA catalog

What to do

If your estate includes any of these products, make sure the vendor’s patches are applied, starting with the most recent vulnerabilities and those used by ransomware, then look for signs of compromise: an exploited vulnerability has often been used before it was fixed.

Additions from all vendors are tracked on the Actively exploited vulnerabilities page, updated several times a day. Sources: CISA KEV catalog (US public domain) and CERT-FR.