Vendor

SonicWall

221 known vulnerabilities.

Products

SonicOS 75 SMA100 26 GMS 24 SMA1000 19 Analytics 15 NetExtender 11 SonicWall SMA100 11 Email Security 11 SonicWall Global VPN Client 5 SonicOSv 5 Network Security Manager (NSM) 5 Global Management System (GMS) 5 SMA 100 Series 4 SonicWall SMA1000 4 Connect Tunnel 3 SonicWall SRA/SMA100 3 SonicWall Switch 2 SonicWall Analytics On-Prem 2 SonicWall NetExtender 2 Directory Services Connector 2 Email Security Appliance 2 SonicWall GMS 2 SonicWall Email Security 2 SonicWall NetExtender Windows (32 and 64 bit) Client 1 Capture Client 1 SonicWall NSM On-Prem 1 Global VPN Client 1 Email Security Virtual Appliance 1 GMS < 9.3.3 0 SMA 1000 Series Firmware 0 SMA 0 SMA Mobile Connect 0 SMA Connect Tunnel 0 SMA NetExtender 0 SMA 1000 0 SMA 100 0 sma100_firmware 0 sonicwall_sonicos__5.9.2.14-13o 0 sonicwall_sonicos__6.5.2.8-2n 0 sonicwall_sonicos__6.5.4.15.116n 0

All Critical High Medium Low Exploited only Public exploit

29 results · Clear filters · Feed

High 7.5

CVE-2026-19868 Exploited Public exploit

An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an al…

SonicWall SonicOS Network devices

Nov 6, 2026
KEV Nov 6, 2026
Medium 6.1

CVE-2026-102258 Public exploit

Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Manage…

SonicWall SMA1000 Network devices

Oct 7, 2026
High 7.2

CVE-2026-102257 Public exploit

A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extra…

SonicWall SMA1000 Network devices

Oct 7, 2026
High 7.8

CVE-2026-102256 Public exploit

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerab…

SonicWall SMA1000 Network devices

Oct 7, 2026
Critical 10.0

CVE-2026-102255 Public exploit

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alter…

SonicWall SMA1000 Network devices

Oct 7, 2026
High 7.8

CVE-2026-83549 Exploited Public exploit

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerab…

SonicWall SMA1000 Network devices

Sep 1, 2026
KEV Sep 2, 2026
Critical 10.0

CVE-2026-83548 Exploited Public exploit

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alter…

SonicWall SMA1000 Network devices

Sep 1, 2026
KEV Sep 2, 2026
High 7.2

CVE-2026-15410 Exploited · Ransomware Public exploit EPSS 12%

Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the …

SonicWall SMA1000 Network devices

Jul 14, 2026
KEV Jul 14, 2026
Critical 10.0

CVE-2026-15409 Exploited · Ransomware Public exploit

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A…

SonicWall SMA1000 Network devices

Jul 14, 2026
KEV Jul 14, 2026
High 7.2

CVE-2026-4112 Public exploit

Improper neutralization of special elements used in an SQL command (“SQL Injection”) in SonicWall SMA1000 series applia…

SonicWall SMA1000 Network devices

Apr 9, 2026
Medium 6.6

CVE-2025-40602 Exploited Public exploit

A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance managem…

SonicWall SMA1000 Network devices

Dec 18, 2025
KEV Dec 17, 2025
High 8.2

CVE-2024-53704 Exploited · Ransomware Public exploit EPSS 95%

An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass auth…

SonicWall SonicOS Network devices

Jan 9, 2025
KEV Feb 18, 2025
High 8.1

CVE-2024-53703 Public exploit EPSS 13%

A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions mod_httprp library loaded b…

SonicWall SMA100 Network devices

Dec 5, 2024
High 7.5

CVE-2023-34133 Public exploit EPSS 73%

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and…

SonicWall GMS Analytics Network devices

Jul 13, 2023
Unscored —

CVE-2023-34132 Public exploit

Use of password hash instead of password for authentication vulnerability in SonicWall GMS and Analytics allows Pass-th…

SonicWall GMS Analytics Network devices

Jul 13, 2023
High 8.8

CVE-2023-34127 Public exploit EPSS 86%

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SonicWall G…

SonicWall GMS Analytics Network devices

Jul 13, 2023
Critical 9.8

CVE-2023-34124 Public exploit EPSS 50%

The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authenticati…

SonicWall GMS Analytics Network devices

Jul 13, 2023
Unscored —

CVE-2023-0656 Public exploit EPSS 41%

A Stack-based buffer overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of …

SonicWall SonicOS Network devices

Mar 2, 2023
Unscored —

CVE-2022-22274 Public exploit EPSS 76%

A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to…

SonicWall SonicOS Network devices

Mar 25, 2022
High 8.8

CVE-2021-20039 Public exploit EPSS 79%

Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method all…

SonicWall SonicWall SMA100 Network devices

Dec 8, 2021
Critical 9.8

CVE-2021-20038 Exploited · Ransomware Public exploit EPSS 100%

A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows…

SonicWall SonicWall SMA100 Network devices

Dec 8, 2021
KEV Jan 28, 2022
Unscored —

CVE-2021-20031 Public exploit EPSS 13%

A Host Header Redirection vulnerability in SonicOS potentially allows a remote attacker to redirect firewall management…

SonicWall SonicOS Network devices

Oct 12, 2021
Unscored —

CVE-2021-20034 Public exploit EPSS 82%

An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversa…

SonicWall SMA100 Network devices

Sep 27, 2021
Critical 9.8

CVE-2021-20021 Exploited · Ransomware Public exploit EPSS 89%

A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account…

SonicWall Email Security Network devices

Apr 9, 2021
KEV Nov 3, 2021
Unscored —

CVE-2020-5148 Public exploit

SonicWall SSO-agent default configuration uses NetAPI to probe the associated IP's in the network, this client probing …

SonicWall Directory Services Connector Network devices

Mar 5, 2021
Unscored —

CVE-2020-5147 Public exploit

SonicWall NetExtender Windows client vulnerable to unquoted service path vulnerability, this allows a local attacker to…

SonicWall SonicWall NetExtender Network devices

Jan 9, 2021
Unscored —

CVE-2020-5142 Public exploit

A stored cross-site scripting (XSS) vulnerability exists in the SonicOS SSLVPN web interface. A remote unauthenticated …

SonicWall SonicOS Network devices

Oct 12, 2020
Unscored —

CVE-2019-7489 Public exploit

A vulnerability in SonicWall Email Security appliance allow an unauthenticated user to perform remote code execution. T…

SonicWall Email Security Appliance Network devices

Dec 23, 2019
Unscored —

CVE-2019-7482 Public exploit

Stack-based buffer overflow in SonicWall SMA100 allows an unauthenticated user to execute arbitrary code in function li…

SonicWall SMA100 Network devices

Dec 19, 2019

SonicWall

Products

An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an al…

Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Manage…

A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extra…

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerab…

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alter…

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerab…

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alter…

Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the …

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A…

Improper neutralization of special elements used in an SQL command (“SQL Injection”) in SonicWall SMA1000 series applia…

A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance managem…

An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass auth…

A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions mod_httprp library loaded b…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and…

Use of password hash instead of password for authentication vulnerability in SonicWall GMS and Analytics allows Pass-th…

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SonicWall G…

The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authenticati…

A Stack-based buffer overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of …

A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to…

Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method all…

A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows…

A Host Header Redirection vulnerability in SonicOS potentially allows a remote attacker to redirect firewall management…

An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversa…

A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account…

SonicWall SSO-agent default configuration uses NetAPI to probe the associated IP's in the network, this client probing …

SonicWall NetExtender Windows client vulnerable to unquoted service path vulnerability, this allows a local attacker to…

A stored cross-site scripting (XSS) vulnerability exists in the SonicOS SSLVPN web interface. A remote unauthenticated …

A vulnerability in SonicWall Email Security appliance allow an unauthenticated user to perform remote code execution. T…

Stack-based buffer overflow in SonicWall SMA100 allows an unauthenticated user to execute arbitrary code in function li…