SonicWall vulnerabilities
We track 112 vulnerabilities in SonicWall products across 60+ products. 109 are rated high or critical, and 24 have been exploited in real attacks. The most recent was published on November 6, 2026.
Latest SonicWall vulnerabilities
- 7.5 High severity
SonicOS: Heap-based Buffer Overflow
A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS SSL-VPN service, which could potentially enable a remote unauthenticated attacker to cause an application level denial of service.
- 7.5 High severity
SonicWall SonicOS SSLVPN Use of Single-factor Authentication Exploited
An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor auth
- 8.8 High severity
SonicOS: Permissive Cross-domain Security Policy with Untrusted Domains
A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.
- 8.8 High severity
SonicOS: Reliance on IP Address for Authentication
A session validation vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.
- 9.1 Critical severity
Global Management System (GMS): Not Failing Securely
An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information.
- 8.8 High severity
Network Security Manager (NSM): Incorrect Authorization
An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information. This may allow the attacker to escala
- 7.2 High severity
Network Security Manager (NSM): Improper Neutralization of Special Elements used in an OS Command
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem which in specific conditions could potentially enable a rem
- 7.2 High severity
SMA1000: Improper Limitation of a Pathname to a Restricted Directory
A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the intended destination directory using a specially crafted archive, resulting in remote code execution.
- 7.8 High severity
SMA1000: Improper Neutralization of Special Elements used in an OS Command
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as a
- 10.0 Critical severity
SMA1000: Unintended Proxy or Intermediary
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the applianc
- 9.1 Critical severity
Network Security Manager (NSM): Improper Limitation of a Pathname to a Restricted Directory
A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive.
- 9.1 Critical severity
Network Security Manager (NSM): Missing Authorization
A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin.
- 9.1 Critical severity
Network Security Manager (NSM): Improper Neutralization of Special Elements used in an OS Command
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbit
- 7.8 High severity
SonicWall SMA1000 Appliances OS Command Injection Exploited
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote au
- 10.0 Critical severity
SonicWall SMA1000 Appliances Server-Side Request Forgery Exploited
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive fun
- 7.0 High severity
NetExtender: Improper Link Resolution Before File Access
The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths.
- 8.3 High severity
GMS: Improper Certificate Validation
An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions which, under a successful MitM attack and controlled network conditions, could permit unauthorized c
- 7.8 High severity
Email Security: Improper Control of Generation of Code
Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root
- 7.8 High severity
Email Security: Improper Control of Generation of Code
Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root
- 9.4 Critical severity
GMS: Improper Control of Generation of Code
An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests.
- 8.4 High severity
GMS: Deserialization of Untrusted Data
An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions. A local attacker with the ability to interact with the service could exploit this behavior to perform
- 9.1 Critical severity
GMS: Improper Control of Generation of Code
An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip.
- 7.2 High severity
SonicWall SMA1000 Appliances Code Injection Exploited
Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administr
- 10.0 Critical severity
SonicWall SMA1000 Appliances Server-Side Request Forgery Exploited
A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.
- 8.0 High severity
SonicOS: Missing Authentication for Critical Functionality
A vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be accessible under specific conditions.
- 7.2 High severity
SMA1000: Improper Handling of Unicode Encoding
Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/Connect Tunnel TOTP authentication.
- 7.2 High severity
SMA1000: Observable Response Discrepancy
An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN user credentials.
- 7.2 High severity
SMA1000: Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an SQL command (“SQL Injection”) in SonicWall SMA1000 series appliances allows a remote authenticated attacker with read-only administrator privileges to escalate privileges to primary administrator.
- 6.6 Medium severity
SonicWall SMA1000 Missing Authorization Exploited
A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).
- 9.8 Critical severity
Email Security: Download of Code Without Integrity Check
Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain persistent arbitrary co
- 7.5 High severity
SonicOS: Stack-based Buffer Overflow
A Stack-based buffer overflow vulnerability in the SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Service (DoS), which could cause an impacted firewall to crash.
- 9.8 Critical severity
SonicOS: Use of Externally-Controlled Format String
Use of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cause service disruption.
- 7.5 High severity
SMA 100 Series: Heap-based Buffer Overflow
A Heap-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution.
- 7.3 High severity
SMA 100 Series: Stack-based Buffer Overflow
A Stack-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution.
- 9.1 Critical severity
SMA 100 Series: Unrestricted Upload of File with Dangerous Type
An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface. A remote attacker with administrative privileges can exploit this flaw to upload arbitrary files to the system, potentially leading to remote code execu
- 7.2 High severity
SMA1000: Server-Side Request Forgery
A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. By using an encoded URL, a remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.
- 7.2 High severity
SMA100: Improper Neutralization of Special Elements used in an OS Command
A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN admin privileges can with admin privileges can inject shell command arguments to upload a file on the appliance.
- 8.8 High severity
SMA100: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges can inject a path traversal sequence to make any directory on the SMA appliance writable.
- 8.8 High severity
SMA100: Files or Directories Accessible to External Parties
A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings.
- 7.2 High severity
SMA1000: Server-Side Request Forgery
A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface, which in specific conditions could potentially enable a remote unauthenticated attacker to cause the appliance to make requests to an unintend