Vendor scorecard
CISA lists 20 SonicWall vulnerabilities as exploited in the wild, 6 of them added in the last 12 months (up from 4 in the 12 months before). 13 (65%) are known to be used in ransomware campaigns. For entries added in the last two years, the median time from CVE publication to the KEV listing was 1 days. Most affected: SMA1000 Appliances (5), SonicOS (3), SonicWall Email Security (3).
| Product | KEV entries |
|---|---|
| SMA1000 Appliances | 5 |
| SonicOS | 3 |
| SonicWall Email Security | 3 |
| SMA100 Appliances | 2 |
| SMA100 | 2 |
| SonicOS SSLVPN | 1 |
| SMA1000 appliance | 1 |
| Secure Remote Access (SRA) | 1 |
| SMA 100 Appliances | 1 |
| SSLVPN SMA100 | 1 |
| CVE | Vulnerability | Added |
|---|---|---|
| CVE-2026-19868 | SonicWall SonicOS SSLVPN Use of Single-factor Authentication VulnerabilitySonicOS SSLVPN | |
| CVE-2026-83549 | SonicWall SMA1000 Appliances OS Command Injection VulnerabilitySMA1000 Appliances | |
| CVE-2026-83548 | SonicWall SMA1000 Appliances Server-Side Request Forgery VulnerabilitySMA1000 Appliances | |
| CVE-2026-15410 | SonicWall SMA1000 Appliances Code Injection VulnerabilityRANSOMWARESMA1000 Appliances | |
| CVE-2026-15409 | SonicWall SMA1000 Appliances Server-Side Request Forgery VulnerabilityRANSOMWARESMA1000 Appliances | |
| CVE-2025-40602 | SonicWall SMA1000 Missing Authorization VulnerabilitySMA1000 appliance | |
| CVE-2023-44221 | SonicWall SMA100 Appliances OS Command Injection VulnerabilitySMA100 Appliances | |
| CVE-2021-20035 | SonicWall SMA100 Appliances OS Command Injection VulnerabilitySMA100 Appliances | |
| CVE-2024-53704 | SonicWall SonicOS SSLVPN Improper Authentication VulnerabilityRANSOMWARESonicOS | |
| CVE-2025-23006 | SonicWall SMA1000 Appliances Deserialization VulnerabilityRANSOMWARESMA1000 Appliances | |
| CVE-2024-40766 | SonicWall SonicOS Improper Access Control VulnerabilityRANSOMWARESonicOS | |
| CVE-2021-20028 | SonicWall Secure Remote Access (SRA) SQL Injection VulnerabilityRANSOMWARESecure Remote Access (SRA) | |
| CVE-2019-7483 | SonicWall SMA100 Directory Traversal VulnerabilitySMA100 | |
| CVE-2020-5135 | SonicWall SonicOS Buffer Overflow VulnerabilityRANSOMWARESonicOS | |
| CVE-2021-20038 | SonicWall SMA 100 Appliances Stack-Based Buffer Overflow VulnerabilityRANSOMWARESMA 100 Appliances | |
| CVE-2021-20023 | SonicWall Email Security Path Traversal VulnerabilityRANSOMWARESonicWall Email Security | |
| CVE-2021-20022 | SonicWall Email Security Unrestricted Upload of File VulnerabilityRANSOMWARESonicWall Email Security | |
| CVE-2021-20021 | SonicWall Email Security Improper Privilege Management VulnerabilityRANSOMWARESonicWall Email Security | |
| CVE-2021-20016 | SonicWall SSLVPN SMA100 SQL Injection VulnerabilityRANSOMWARESSLVPN SMA100 | |
| CVE-2019-7481 | SonicWall SMA100 SQL Injection VulnerabilityRANSOMWARESMA100 |
Get an email when CISA adds the next SonicWall CVE.
How to read this: CISA KEV lists vulnerabilities with reliable evidence of exploitation; a vendor with many entries is often one with a large, internet-facing install base, not necessarily worse engineering. "Publication → KEV" is the median number of days between the CVE's publication and its addition to KEV, for entries added in the last 24 months (9 entries); it is an upper bound on how long defenders had, since exploitation usually starts before the listing. Under NIS2 article 21(2)(d), supplier security is part of your risk management; this page is a starting point for that review. Compare vendors on the scorecard index.
We assess supplier security for NIS2 and DORA, from exploited-CVE history and patch response to contract clauses and evidence packs.
Get in touch →