vendor4 exploited in the wild

Sonicwall

4 CVEs published in the last four months and 9 stories. Exploited flaws first.

Critical2

High2

Medium0

Exploited (KEV)4

Patch these first

CVE	CVSS	Severity	Product	Summary	Published
CVE-2026-15409exploited	10	critical	sma6210 firmware	A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interfa	100d ago
CVE-2026-83548exploited	10	critical	sma8200v	A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended	51d ago
CVE-2026-83549exploited	7.8	high	sma8200v	Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vul	51d ago
CVE-2026-15410exploited	7.2	high	sma6210 firmware	Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in	100d ago

All recent CVEs

CVE	CVSS	Severity	Product	Summary	Published
CVE-2026-15409exploited	10	critical	sma6210 firmware	A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interfa	100d ago
CVE-2026-83548exploited	10	critical	sma8200v	A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended	51d ago
CVE-2026-83549exploited	7.8	high	sma8200v	Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vul	51d ago
CVE-2026-15410exploited	7.2	high	sma6210 firmware	Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in	100d ago

Filter the full tracker by Sonicwall →

Our coverage of Sonicwall

CVE-2026-83549Sep 6, 2026high

SonicWall SMA1000 OS Command Injection Exploited Same Day as Disclosure

A critical OS command injection vulnerability in SonicWall SMA1000 Appliances was exploited on the same day it was publicly disclosed, leaving no patch window for affected organizations.

CVE-2026-83548Sep 6, 2026critical

SonicWall SMA1000 SSRF Flaw Exploited Same Day as Disclosure

A critical pre-authentication SSRF vulnerability in SonicWall SMA1000 appliances was exploited on the same day it was publicly disclosed, leaving no patch window for affected organizations.

vulnerabilitySep 3, 2026high

Attackers exploit zero-days in consistently besieged SonicWall product

SonicWall customers are once again facing actively exploited zero-day vulnerabilities in the company's SMA 1000 appliances. The vendor disclosed and patched two new defects, CVE-2026-83548 and CVE-2026-83549, on Tuesday, confirming that both were already being exploited in the wild. The Cybersecurity and Infrastructure Security Agency (CISA) added these vulnerabilities to its Known Exploited…

vulnerabilitySep 2, 2026

SonicWall SMA 1000 Zero-Days Enable Unauthenticated RCE

Reports indicate that multiple zero-day vulnerabilities have been discovered and are actively being exploited in SonicWall SMA 1000 series products. These critical flaws reportedly enable unauthenticated remote code execution (RCE), posing a significant risk to organizations utilizing these secure mobile access devices. The nature of unauthenticated RCE means an attacker could potentially…

sonicwallAug 10, 2026critical

Ransomware Gangs Exploit SonicWall SMA1000 Vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware groups are actively exploiting two recently patched vulnerabilities in SonicWall SMA1000 secure remote access gateways. These flaws, identified as CVE-2026-15409 and CVE-2026-15410, include a maximum-severity server-side request forgery (SSRF) vulnerability.

ransomwareAug 4, 2026

Prolific ransomware group behind SonicWall zero-day attacks

INC ransomware, a prominent ransomware-as-a-service operation, has been identified as a primary threat actor exploiting a pair of recently disclosed SonicWall zero-day vulnerabilities, CVE-2026-15409 and CVE-2026-15410. While other actors engaged in exploitation prior to public disclosure, INC ransomware has been particularly effective in chaining these vulnerabilities to achieve data theft…

vulnerabilityJul 20, 2026

SonicWall SMA1000 flaws exploited as zero-days to push custom malware

SonicWall's SMA1000 Secure Mobile Access appliances were targeted in zero-day attacks for several weeks, with threat actors exploiting two vulnerabilities to install custom malware. The company confirmed the exploitation of these previously undisclosed flaws, urging customers to apply patches immediately.

CVE-2026-15409Jul 19, 2026critical

SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access

Reports indicate that a sophisticated threat actor, identified as UTA0533, has been actively exploiting two zero-day vulnerabilities within SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances. These exploits were reportedly chained together to achieve arbitrary command execution and subsequently gain root access on affected systems. The exploitation occurred prior to the public…

ransomwareJul 17, 2026critical

Inc Ransomware Exploits SonicWall SMA Zero-Days

Reports indicate that the Inc ransomware group is currently leveraging two previously undisclosed zero-day vulnerabilities within SonicWall's Secure Mobile Access (SMA) appliances. This active exploitation has been observed to grant attackers root-level control over the compromised devices, which can then be used as a pivot point for broader malicious operations within a targeted network.