SonicWall Firewall and Security firm

Known Exploited SonicWall Vulnerabilities

The following SonicWall vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Of the known exploited vulnerabilities above, 7 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings. 7 known exploited SonicWall vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 29 vulnerabilities in SonicWall with an average score of 6.9 out of ten. Last year, in 2025 SonicWall had 20 security vulnerabilities published. That is, 9 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.45

Recent SonicWall Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-66153	Aug 25, 2026	SonicWall NetExtender Linux Client Temp File Path Manipulation in Auto-Upgrade The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths.	Netextender
CVE-2026-66152	Aug 25, 2026	SonicWall NetExtender: Path Traversal Enables Root Write via tarball A Path traversal vulnerability in OPSWAT tarball in the SonicWall NetExtender Linux client allows an attacker to write arbitrary file as root.	Netextender
CVE-2026-66150	Aug 11, 2026	SonicWall Email Security CLI: Code Injection via SNMP as Root Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via SNMP.	Email Security
CVE-2026-66149	Aug 11, 2026	SonicWall Email Security: Code Injection via netmask CLI (CVE-2026-66149) Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask.	Email Security
CVE-2026-18634	Aug 11, 2026	SonicWall GMS <=9.5.1 insecure serialized objects (CVE-2026-18634) An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions. A local attacker with the ability to interact with the service could exploit this behavior to perform unauthorized actions through the affected component.
CVE-2026-66154	Aug 11, 2026	Insufficient Cert Validation in SonicWall GMS 9.5.1 (Privileged Workflow) An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions which, under a successful MitM attack and controlled network conditions, could permit unauthorized changes.
CVE-2026-66148	Aug 11, 2026	Cmd injection in SonicWall GMS CLI <9.5.1 An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier versions which allows low-privileged local user to execute system commands with root privileges.
CVE-2026-66147	Aug 11, 2026	CVE-2026-66147: GMS 9.5.1 Command Injection via Dispatcher An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests.
CVE-2026-66146	Aug 11, 2026	SonicWall GMS 9.5.x XSS Enables Remote JS Execution Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote attacker to execute javascript script in a user's browser.
CVE-2026-66145	Aug 11, 2026	Unauthenticated RCE via ZipSlip in SonicWall GMS <9.5.1 An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip.
CVE-2026-66151	Aug 07, 2026	SonicWall Global VPN Client <4.10.8.1108: SWIPsec.sys OOB Read Crash SonicWall Global VPN Client version 4.10.8.1108 and earlier is vulnerable to an out-of-bounds kernel memory read in the SWIPsec.sys driver, which could allow a local attacker to cause a system crash.	Global Vpn Client
CVE-2026-0516	Aug 05, 2026	HTTP Header Injection in SonicOS Allows Host Header Manipulation A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the Host header and redirect firewall management users to arbitrary web domains.	Sonicos
CVE-2026-15410	Jul 14, 2026	SonicWall SMA1000 AMC: Authenticated Code Injection (OS Exec) Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.
CVE-2026-15409	Jul 14, 2026	SSRF Vulnerability in SonicWall SMA1000 Appliance Work Place A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.
CVE-2026-0206	Apr 29, 2026	SonicOS Post-Auth Stack Buf Overflow Crash A post-authentication Stack-based Buffer Overflow vulnerabilities in SonicOS allows a remote attacker to crash a firewall.	Sonicos
CVE-2026-0205	Apr 29, 2026	Post-Auth Path Traversal in SonicOS A post-authentication Path Traversal vulnerability in SonicOS allows an attacker to interact with usually restricted services.	Sonicos
CVE-2026-0204	Apr 29, 2026	SonicOS AMI Access Control Bypass (CVE-2026-0204) A vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be accessible under specific conditions.	Sonicos
CVE-2026-4116	Apr 09, 2026	SonicWall SMA1000 SSLVPN TOTP Bypass via Unicode Encoding Flaw Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/Connect Tunnel TOTP authentication.
CVE-2026-4114	Apr 09, 2026	SonicWall SMA1000 Auth Bypass via Unicode in SSLVPN TOTP Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN admin to bypass AMC TOTP authentication.
CVE-2026-4113	Apr 09, 2026	SSL VPN Credential Enumeration in SonicWall SMA1000 An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN user credentials.
CVE-2026-4112	Apr 09, 2026	SonicWall SMA1000 Series SQLi Remote Auth Priv Escalation Improper neutralization of special elements used in an SQL command (SQL Injection) in SonicWall SMA1000 series appliances allows a remote authenticated attacker with read-only administrator privileges to escalate privileges to primary administrator.
CVE-2026-3470	Mar 31, 2026	SonicWall Email Security: Remote Auth DB Corruption via Improper Input Sanit. A vulnerability exists in the SonicWall Email Security appliance due to improper input sanitization that may lead to data corruption, allowing a remote authenticated attacker as admin user could exploit this issue by providing crafted input that corrupts application database.	Email Security
CVE-2026-3469	Mar 31, 2026	DoS via Validation in SonicWall Email Security Appliance A denial-of-service (DoS) vulnerability exists due to improper input validation in the SonicWall Email Security appliance, allowing a remote authenticated attacker as admin user to cause the application to become unresponsive.	Email Security
CVE-2026-3468	Mar 31, 2026	Stored XSS in SonicWall Email Security appliance via web page gen A stored Cross-Site Scripting (XSS) vulnerability has been identified in the SonicWall Email Security appliance due to improper neutralization of user-supplied input during web page generation, allowing a remote authenticated attacker as admin user to potentially execute arbitrary JavaScript code.	Email Security
CVE-2026-3439	Mar 04, 2026	SonicOS Stack-Based Buffer Overflow in Cert Handling Enables Crash A post-authentication Stack-based Buffer Overflow vulnerability in SonicOS certificate handling allows a remote attacker to crash a firewall.	Sonicos
CVE-2026-0402	Feb 24, 2026	SonicOS Post-Auth OOB Read Crash Vulnerability A post-authentication Out-of-bounds Read vulnerability in SonicOS allows a remote attacker to crash a firewall.	Sonicos
CVE-2026-0401	Feb 24, 2026	NULL Pointer Deref in SonicOS Firewall PostAuth Crash Vulnerability A post-authentication NULL Pointer Dereference vulnerability in SonicOS allows a remote attacker to crash a firewall.	Sonicos
CVE-2026-0400	Feb 24, 2026	SonicOS Post-Auth Format String Crash CVE-2026-0400 A post-authentication Format String vulnerability in SonicOS allows a remote attacker to crash a firewall.	Sonicos
CVE-2026-0399	Feb 24, 2026	SonicOS API stack buffer overflow (post-auth) Multiple post-authentication stack-based buffer overflow vulnerabilities in the SonicOS management interface due to improper bounds checking in a API endpoint.	Sonicos
CVE-2025-40602	Dec 18, 2025	SonicWall SMA1000 AMC LPE via Insufficient Auth A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).
CVE-2025-40601	Nov 20, 2025	SonicOS SSLVPN Buffer Overflow Remote Unauth DoS A Stack-based buffer overflow vulnerability in the SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Service (DoS), which could cause an impacted firewall to crash.	Sonicos
CVE-2025-40605	Nov 20, 2025	Email Sec Appliance Path Traversal Unauthorized File Access A Path Traversal vulnerability has been identified in the Email Security appliance allows an attacker to manipulate file system paths by injecting crafted directory-traversal sequences (such as ../) and may access files and directories outside the intended restricted path.	Email Security
CVE-2025-40604	Nov 20, 2025	SonicWall Email Security Appliance: Root FS Image Integrity Check Bypass Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain persistent arbitrary code execution.	Email Security
CVE-2025-40603	Oct 31, 2025	SonicWall SMA100 Remote Auth Admin Log Info Leak (CVE-2025-40603) A potential exposure of sensitive information in log files in SonicWall SMA100 Series appliances may allow a remote, authenticated administrator, under certain conditions to view partial users credential data.	Sma100
CVE-2025-40600	Jul 29, 2025	SonicOS SSL VPN Format String Causing DoS Use of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cause service disruption.	Sonicos
CVE-2025-32821	May 07, 2025	SMA100 SSLVPN Command Injection: File Upload by Authenticated Attacker A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN admin privileges can with admin privileges can inject shell command arguments to upload a file on the appliance.
CVE-2025-32819	May 07, 2025	SMA100 SSLVPN Auth Path Traversal File Deletion (CVE-2025-32819) A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings.
CVE-2025-2170	Apr 30, 2025	SSRF in SMA1000 WorkPlace Interface Allows Remote UnAuth Requests A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface, which in specific conditions could potentially enable a remote unauthenticated attacker to cause the appliance to make requests to an unintended location.	Sma1000 Firmware
CVE-2025-32818	Apr 23, 2025	SonicOS SSLVPN Virtual Office NPE in SSLVPN Interface allows Remote DoS A Null Pointer Dereference vulnerability in the SonicOS SSLVPN Virtual office interface allows a remote, unauthenticated attacker to crash the firewall, potentially leading to a Denial-of-Service (DoS) condition.	Sonicos
CVE-2025-23010	Apr 10, 2025	Link Following in SonicWall NetExtender Windows Client An Improper Link Resolution Before File Access ('Link Following') vulnerability in SonicWall NetExtender Windows (32 and 64 bit) client which allows an attacker to manipulate file paths.	Netextender
CVE-2025-23009	Apr 10, 2025	CVE-2025-23009: LPE in SonicWall NetExtender (32/64-bit) -> File Delete A local privilege escalation vulnerability in SonicWall NetExtender Windows (32 and 64 bit) client which allows an attacker to trigger an arbitrary file deletion.	Netextender
CVE-2025-23006	Jan 23, 2025	Remote OS Command Exec via Pre-auth Deserialization in SMA1000 AMC/CMC Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.	Sma8200v
CVE-2024-12802	Jan 09, 2025	SonicWALL SSLVPN MFA Bypass via UPN/SAM Splitting SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Security Account Manager) account names when integrated with Microsoft Active Directory, allowing MFA to be configured independently for each login method and potentially enabling attackers to bypass MFA by exploiting the alternative account name.	Sonicos
CVE-2024-12806	Jan 09, 2025	SonicOS Admin Absolute Path Traversal Enables Post-Auth File Read A post-authentication absolute path traversal vulnerability in SonicOS management allows a remote attacker to read an arbitrary file.	Sonicos
CVE-2024-40765	Jan 09, 2025	Integer Overflow in SonicOS IPSec (IKEv2) Remote DoS/Exec An Integer-based buffer overflow vulnerability in the SonicOS via IPSec allows a remote attacker in specific conditions to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a specially crafted IKEv2 payload.	Sonicos
CVE-2024-12803	Jan 09, 2025	SonicOS CLI Buffer Overflow Enables Remote Crash A post-authentication stack-based buffer overflow vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads to code execution.	Sonicos
CVE-2024-12805	Jan 09, 2025	SonicOS Post-Auth Format String Vulnerability Enables Crash & RCE A post-authentication format string vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads to code execution.	Sonicos
CVE-2024-53705	Jan 09, 2025	SSRF in SonicOS SSH Mgmt Enables Remote TCP Connections A Server-Side Request Forgery vulnerability in the SonicOS SSH management interface allows a remote attacker to establish a TCP connection to an IP address on any port when the user is logged in to the firewall.	Sonicos
CVE-2024-53704	Jan 09, 2025	Improper Auth in SSLVPN auth bypass vulnerability An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.	Sonicos
CVE-2024-40766	Aug 23, 2024	SonicWall SonicOS 7.0.1-5035 MM Access Control Vulnerability An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.	Sonicos