https://vulnogram.org/ Most recent CVEs assigned by SonicWall, Inc. (sonicwall). https://vulnogram.org/seaview/icons/sonicwall.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-100232 https://vulnogram.org/CVE-2026-100232 Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem which in specific conditions could potentially en… High Wed, 14 Oct 2026 20:08:36 GMT https://vulnogram.org/CVE-2026-96540 https://vulnogram.org/CVE-2026-96540 An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information. This may allow the attacker… High Wed, 14 Oct 2026 20:06:24 GMT https://vulnogram.org/CVE-2026-102258 https://vulnogram.org/CVE-2026-102258 Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to store… Medium Network Exploitable Wed, 07 Oct 2026 13:16:31 GMT https://vulnogram.org/CVE-2026-102257 https://vulnogram.org/CVE-2026-102257 A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the intended destination directory using a specially crafted archive, resulting in remote code execution. High Wed, 07 Oct 2026 13:12:25 GMT https://vulnogram.org/CVE-2026-102256 https://vulnogram.org/CVE-2026-102256 Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated att… High Wed, 07 Oct 2026 13:09:04 GMT https://vulnogram.org/CVE-2026-102255 https://vulnogram.org/CVE-2026-102255 A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct th… Critical Network Exploitable Wed, 07 Oct 2026 13:07:13 GMT https://vulnogram.org/CVE-2026-81939 https://vulnogram.org/CVE-2026-81939 A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive. Critical Fri, 04 Sep 2026 18:22:16 GMT https://vulnogram.org/CVE-2026-78328 https://vulnogram.org/CVE-2026-78328 A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin. Critical Fri, 04 Sep 2026 18:19:29 GMT https://vulnogram.org/CVE-2026-78327 https://vulnogram.org/CVE-2026-78327 An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to in… Critical Fri, 04 Sep 2026 18:14:54 GMT https://vulnogram.org/CVE-2026-83549 https://vulnogram.org/CVE-2026-83549 Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a… High Known Exploited Tue, 01 Sep 2026 21:28:50 GMT https://vulnogram.org/CVE-2026-83548 https://vulnogram.org/CVE-2026-83548 A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sen… Critical Known Exploited Network Exploitable Tue, 01 Sep 2026 21:25:45 GMT https://vulnogram.org/CVE-2026-66153 https://vulnogram.org/CVE-2026-66153 The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths. High Tue, 25 Aug 2026 20:01:15 GMT https://vulnogram.org/CVE-2026-66152 https://vulnogram.org/CVE-2026-66152 A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root. High Network Exploitable Tue, 25 Aug 2026 19:58:47 GMT https://vulnogram.org/CVE-2026-66150 https://vulnogram.org/CVE-2026-66150 Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execut… High Tue, 11 Aug 2026 20:19:34 GMT https://vulnogram.org/CVE-2026-66149 https://vulnogram.org/CVE-2026-66149 Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execut… High Tue, 11 Aug 2026 20:18:25 GMT https://vulnogram.org/CVE-2026-18634 https://vulnogram.org/CVE-2026-18634 An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions. A local attacker with the ability to interact with the service could exploit this behavior t… High Tue, 11 Aug 2026 20:14:19 GMT https://vulnogram.org/CVE-2026-66154 https://vulnogram.org/CVE-2026-66154 An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions which, under a successful MitM attack and controlled network conditions, could permit unau… High Tue, 11 Aug 2026 20:12:25 GMT https://vulnogram.org/CVE-2026-66148 https://vulnogram.org/CVE-2026-66148 An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier versions which allows low-privileged local user to execute system commands with root privileges. Medium Tue, 11 Aug 2026 20:10:39 GMT https://vulnogram.org/CVE-2026-66147 https://vulnogram.org/CVE-2026-66147 An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests. Critical Network Exploitable Tue, 11 Aug 2026 20:08:56 GMT https://vulnogram.org/CVE-2026-66146 https://vulnogram.org/CVE-2026-66146 Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote attacker to execute javascript script in a user's browser. Medium Network Exploitable Tue, 11 Aug 2026 20:07:05 GMT https://vulnogram.org/CVE-2026-66145 https://vulnogram.org/CVE-2026-66145 An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip. Critical Network Exploitable Tue, 11 Aug 2026 20:05:18 GMT https://vulnogram.org/CVE-2026-66151 https://vulnogram.org/CVE-2026-66151 SonicWall Global VPN Client version 4.10.8.1108 and earlier is vulnerable to an out-of-bounds kernel memory read in the SWIPsec.sys driver, which could allow a local attacker to cause a system crash. Medium Fri, 07 Aug 2026 20:10:19 GMT https://vulnogram.org/CVE-2026-0516 https://vulnogram.org/CVE-2026-0516 A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the Host header and redirect firewall management users to arbitrary web domains. Medium Network Exploitable Wed, 05 Aug 2026 11:50:03 GMT https://vulnogram.org/CVE-2026-15410 https://vulnogram.org/CVE-2026-15410 Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as… High Known Exploited Tue, 14 Jul 2026 19:43:03 GMT https://vulnogram.org/CVE-2026-15409 https://vulnogram.org/CVE-2026-15409 A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location. Critical Known Exploited Network Exploitable Tue, 14 Jul 2026 19:39:34 GMT https://vulnogram.org/CVE-2026-0206 https://vulnogram.org/CVE-2026-0206 A post-authentication Stack-based Buffer Overflow vulnerabilities in SonicOS allows a remote attacker to crash a firewall. Medium Wed, 29 Apr 2026 16:21:40 GMT https://vulnogram.org/CVE-2026-0205 https://vulnogram.org/CVE-2026-0205 A post-authentication Path Traversal vulnerability in SonicOS allows an attacker to interact with usually restricted services. Medium Wed, 29 Apr 2026 16:18:45 GMT https://vulnogram.org/CVE-2026-0204 https://vulnogram.org/CVE-2026-0204 A vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be accessible under specific conditions. High Wed, 29 Apr 2026 16:15:32 GMT https://vulnogram.org/CVE-2026-4116 https://vulnogram.org/CVE-2026-4116 Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/Connect Tunnel TOTP authentication. High Thu, 09 Apr 2026 14:27:29 GMT https://vulnogram.org/CVE-2026-4114 https://vulnogram.org/CVE-2026-4114 Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN admin to bypass AMC TOTP authentication. Medium Thu, 09 Apr 2026 14:25:41 GMT https://vulnogram.org/CVE-2026-4113 https://vulnogram.org/CVE-2026-4113 An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN user credentials. High Thu, 09 Apr 2026 14:23:53 GMT https://vulnogram.org/CVE-2026-4112 https://vulnogram.org/CVE-2026-4112 Improper neutralization of special elements used in an SQL command (“SQL Injection”) in SonicWall SMA1000 series appliances allows a remote authenticated attacker with read-only administrator privileges to escalate privileges to primary administrator… High Thu, 09 Apr 2026 14:22:21 GMT https://vulnogram.org/CVE-2026-3470 https://vulnogram.org/CVE-2026-3470 A vulnerability exists in the SonicWall Email Security appliance due to improper input sanitization that may lead to data corruption, allowing a remote authenticated attacker as admin user could exploit this issue by providing crafted input that corr… Low Tue, 31 Mar 2026 20:19:38 GMT https://vulnogram.org/CVE-2026-3469 https://vulnogram.org/CVE-2026-3469 A denial-of-service (DoS) vulnerability exists due to improper input validation in the SonicWall Email Security appliance, allowing a remote authenticated attacker as admin user to cause the application to become unresponsive. Low Tue, 31 Mar 2026 20:18:32 GMT https://vulnogram.org/CVE-2026-3468 https://vulnogram.org/CVE-2026-3468 A stored Cross-Site Scripting (XSS) vulnerability has been identified in the SonicWall Email Security appliance due to improper neutralization of user-supplied input during web page generation, allowing a remote authenticated attacker as admin user t… Medium Tue, 31 Mar 2026 20:17:11 GMT https://vulnogram.org/CVE-2026-3439 https://vulnogram.org/CVE-2026-3439 A post-authentication Stack-based Buffer Overflow vulnerability in SonicOS certificate handling allows a remote attacker to crash a firewall. Medium Wed, 04 Mar 2026 09:19:45 GMT https://vulnogram.org/CVE-2026-0402 https://vulnogram.org/CVE-2026-0402 A post-authentication Out-of-bounds Read vulnerability in SonicOS allows a remote attacker to crash a firewall. Medium Tue, 24 Feb 2026 14:58:37 GMT https://vulnogram.org/CVE-2026-0401 https://vulnogram.org/CVE-2026-0401 A post-authentication NULL Pointer Dereference vulnerability in SonicOS allows a remote attacker to crash a firewall. Medium Tue, 24 Feb 2026 14:55:57 GMT https://vulnogram.org/CVE-2026-0400 https://vulnogram.org/CVE-2026-0400 A post-authentication Format String vulnerability in SonicOS allows a remote attacker to crash a firewall. Medium Tue, 24 Feb 2026 14:54:15 GMT https://vulnogram.org/CVE-2026-0399 https://vulnogram.org/CVE-2026-0399 Multiple post-authentication stack-based buffer overflow vulnerabilities in the SonicOS management interface due to improper bounds checking in a API endpoint. Medium Tue, 24 Feb 2026 14:52:10 GMT https://vulnogram.org/CVE-2025-40602 https://vulnogram.org/CVE-2025-40602 A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC). Medium Known Exploited Thu, 18 Dec 2025 10:58:41 GMT https://vulnogram.org/CVE-2025-40601 https://vulnogram.org/CVE-2025-40601 A Stack-based buffer overflow vulnerability in the SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Service (DoS), which could cause an impacted firewall to crash. High Network Exploitable Thu, 20 Nov 2025 12:26:54 GMT https://vulnogram.org/CVE-2025-40605 https://vulnogram.org/CVE-2025-40605 A Path Traversal vulnerability has been identified in the Email Security appliance allows an attacker to manipulate file system paths by injecting crafted directory-traversal sequences (such as ../) and may access files and directories outside the in… Medium Network Exploitable Thu, 20 Nov 2025 12:19:17 GMT https://vulnogram.org/CVE-2025-40604 https://vulnogram.org/CVE-2025-40604 Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain persistent ar… Medium Network Exploitable Thu, 20 Nov 2025 12:17:14 GMT https://vulnogram.org/CVE-2025-40603 https://vulnogram.org/CVE-2025-40603 A potential exposure of sensitive information in log files in SonicWall SMA100 Series appliances may allow a remote, authenticated administrator, under certain conditions to view partial users credential data. Medium Fri, 31 Oct 2025 11:01:35 GMT https://vulnogram.org/CVE-2025-40600 https://vulnogram.org/CVE-2025-40600 Use of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cause service disruption. Critical Network Exploitable Tue, 29 Jul 2025 21:11:59 GMT https://vulnogram.org/CVE-2025-40598 https://vulnogram.org/CVE-2025-40598 A Reflected cross-site scripting (XSS) vulnerability exists in the SMA100 series web interface, allowing a remote unauthenticated attacker to potentially execute arbitrary JavaScript code. Medium Network Exploitable Wed, 23 Jul 2025 14:49:48 GMT https://vulnogram.org/CVE-2025-40597 https://vulnogram.org/CVE-2025-40597 A Heap-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution. High Network Exploitable Wed, 23 Jul 2025 14:48:36 GMT https://vulnogram.org/CVE-2025-40596 https://vulnogram.org/CVE-2025-40596 A Stack-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution. High Network Exploitable Wed, 23 Jul 2025 14:46:24 GMT https://vulnogram.org/CVE-2025-40599 https://vulnogram.org/CVE-2025-40599 An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface. A remote attacker with administrative privileges can exploit this flaw to upload arbitrary files to the system, potentially leading to remote… Critical Wed, 23 Jul 2025 13:13:45 GMT