SonicWall Vulnerabilities 2026: 42 CVEs So Far, 56% More Than Last Year, and Every New KEV Entry Is SMA 1000

As of November 5, 2026, the count of SonicWall vulnerabilities 2026 stands at 42 CVEs across 15 PSIRT advisories, up from 27 in the same months of 2025. All 4 CISA KEV additions this year hit SMA 1000, each with a 3 day federal deadline. The newest advisory, SNWLID-2026-0019 on November 3, covers end-of-life GMS and has no fix.

Figure 1. SonicWall CVEs by product line and year, shaded by KEV additions

*2026 runs to November 5. Numbers are CVEs named in PSIRT advisories marked Applicable, counted in the advisory’s year; a CVE on several product lines counts in each row. Shading and “KEV” count the entries CISA added in that year, whenever the CVE was first published, so a 2025 KEV entry may be an older flaw. The KEV catalog began on November 3, 2021.

What changed most recently

• Nov 3: SNWLID-2026-0019, end-of-life GMS 9.5.2 and earlier. CVE-2026-109593 scores 9.1 with no login needed. SonicWall lists no fix and no workaround.
• Oct 22: PHP notice. SonicWall’s initial review found no PHP in SonicOS, SMA 1000, NSM, MySonicWall, Email Security and three other products. It was still assessing switches and SonicWave access points. These CVEs are not in our count.
• Oct 14: SNWLID-2026-0018, NSM on-premises 4.3.1 and earlier. Fixed in 4.4.0. NSM SaaS is not affected.
• Oct 6: SNWLID-2026-0017, SMA 1000. CVE-2026-102255 scores 10.0 with no login needed. It is the fourth required SMA 1000 hotfix of 2026.

Every 2026 SonicWall CVE, dated

The 42 records below come from SonicWall’s own PSIRT feed and match NVD’s count for 2026. The two CVSS columns can differ because SonicWall publishes one score and CISA’s enrichment program, the score NVD displays for these records, publishes another. They disagree on 7 of 42 CVEs: for CVE-2026-78328, SonicWall says 7.2 and CISA says 9.1, and for CVE-2026-0516, SonicWall says 4.3 and CISA says 6.5. 23 of the 42 still show Awaiting Analysis in NVD.

SNWLID numbers 2026-0005, 0006, 0007 and 0014 return an empty, unpublished record from the PSIRT API, so they are not in this list. SNWLID-2026-0011 lists 6 CVEs in its text, but its CVE field holds only 4. Red rows are in KEV.

2026 against earlier years, same window

The January 1 to November 5 window in 2026 has the most SonicWall CVEs of any year since 2019: 42, against 36 in 2023, the previous high, and 27 in 2025. The number of advisories barely moved, 15 against 16, so the growth is more CVEs per advisory: 2.8 against 1.7. CVEs scoring 9.0 or higher rose to 8 from 2. KEV additions did not rise, at 4 in both years. What changed is where they landed and how fast.

Figure 2. SonicWall CVEs, January 1 to November 5 of each year

The 2023 total is lifted by SNWLID-2023-0010, which named 15 GMS and Analytics CVEs at once. In 2021 the 5 KEV additions are from the catalog’s launch day. CVE-2025-40602 was added on December 17, 2025, after the window. Our VPN vendor scorecard compares SonicWall with other gateway vendors; that comparison is not repeated here.

SMA 1000: four required hotfixes in 2026, and the gap is shrinking

12 of the 42 CVEs affect SMA 1000, up from 4 in all of 2025. All 4 KEV additions came from two of its advisories. The pattern that matters is the build ladder: each 2026 advisory treats the previous advisory’s fixed build as affected.

Figure 3. Minimum fixed SMA 1000 build after each advisory

The September 1 advisory fixed 12.4.3-03526 and 12.5.0-02952. The October 6 advisory lists those same builds as affected, 35 days later. The intervals between required hotfixes ran 112, 97, 49 and 35 days. CVE-2026-83548 and CVE-2026-102255 share the title “Pre-authentication SSRF via unintended forward-proxy” and both hit the Work Place interface. SonicWall has not said whether the second is a bypass of the first, and we are not claiming it is.

The July notice says the flaws were confirmed as actively exploited, and the PSIRT record credits Volexity for help with the investigation. The October notice says there is no evidence of exploitation and has not changed since October 6. SecurityWeek reported on October 12 that Defused saw first attempts on its decoys on October 8 and that Previdian’s sensors saw attempts consistent with CVE-2026-102255. Those are third-party sensor reports. The CVE was not in KEV in catalog version 2026.11.04, and CISA’s enrichment record for it, dated October 7, the day before those first attempts, says no known exploitation. Treat it as an open question and patch as if it were exploited.

All 19 SonicWall entries in CISA KEV

The time from advisory to KEV listing has collapsed. KEV entries added before 2024 came a median 258 days after the PSIRT advisory, partly because the catalog was new. All 4 entries added in 2026 came 0 or 1 day after it. The federal fix window was 21 days on most entries through mid-2025 and 7 days on CVE-2025-40602 in December 2025. It is 3 days on all 4 of 2026, whose KEV entries cite BOD 26-04 of June 10, 2026 and add CISA’s Forensics Triage Requirements on top of patching.

Figure 4. Days from PSIRT advisory to KEV listing (log scale)

The ransomware column is a lagging field, since CISA can change it later. It is set to Known on 13 of the 19, including both CVEs added on July 14, 2026. Neither of the September 2026 pair carries it yet. Our KEV catalog analysis shows how this compares with the full catalog.

The September to October 2025 MySonicWall cloud backup incident

SonicWall’s account changed materially during the investigation. Its notice carries a dated change log, so the revision can be read directly.

• Sep 17, 2025: Notice published. A same-day revision gives the scope as under 5% of firewalls and describes a brute-force attack, not ransomware.
• Sep 22, 2025: CISA alert says the files included information actors could use to gain access to customers’ firewalls, and urges customers to check their accounts.
• Oct 8, 2025: After Mandiant’s review, the notice changes to say an unauthorized party accessed backup files for all customers who used the cloud backup service.
• Oct 28, 2025: Last update to the notice, adding the Credentials Reset Tool.
• Nov 4, 2025: SonicWall blog says the investigation is complete, a state-sponsored actor used an API call, and the incident is unrelated to the Akira attacks. It says products, firmware and customer networks were not compromised.

What the files hold matters for remediation. SonicWall says the configuration is encoded, not encrypted, while credentials inside are individually encrypted, with AES-256 on Gen 7 and newer and 3DES on Gen 6. Its tiering is Active High Priority (internet-facing services), Active Lower Priority, and Inactive (no contact for 90 days), listed in MySonicWall under Product Management, then Issue List.

2026 follow-up. We found none from SonicWall. We walked its support notice chain from that notice to October 2026 and found 9 later notices, none about the incident. Two live signs remain. SonicWall’s Remediation Playbook shows an update date of June 18, 2026 and points to an online configuration analysis tool; the page does not say what changed. The Migration Tool still warns that preference files created before September 17, 2025 may be affected and that credentials should be changed after restoring one.

Akira, as SonicWall and CISA state it

SonicWall’s August 2025 notice says it has high confidence the SSLVPN activity on Gen 7 firewalls was not a zero-day. It reports a significant correlation with CVE-2024-40766, fewer than 40 incidents under investigation, and many tied to Gen 6 to Gen 7 migrations where local passwords were not reset. That notice does not name Akira. SonicWall’s later blog does, only to say the cloud backup incident is unrelated.

CISA advisory AA24-109A, revised November 13, 2025, says Akira actors gain access to VPN products such as SonicWall by stealing credentials or exploiting vulnerabilities like CVE-2024-40766. It also says they likely abused that CVE for initial access in a June 2025 incident. CISA’s KEV entry for CVE-2024-40766, added September 9, 2024, carries the Known ransomware flag. We found no SonicWall or CISA document from 2026 that links Akira to a 2026 CVE. Vendor and press claims beyond these documents are left out.

SMA 100 end-of-life facts, from SonicWall

The grid shows a zero for SMA 100 in 2026. That is the result of support ending, not a sign the product became safe: the last applicable PSIRT advisory, SNWLID-2025-0017, came on October 30, 2025, two days before end of support. CISA added two old SMA 100 flaws to KEV in 2025 (CVE-2021-20035 and CVE-2023-44221), 1301 and 514 days after their advisories, which shows how long a flaw in this line can stay useful to attackers.

Filter every SonicWall CVE since 2019

All 248 CVEs in applicable PSIRT advisories since January 2019, newest first. Use the filters to narrow it. The download below has the same data with CWE, CISA scores and NVD status.

What this means for MSPs

SMA 1000: treat the minimum build as a moving target. Anything below 12.4.3-03670 or 12.5.0-03082 is below the October fix, including servers you patched in September. SonicWall lists no workaround on the last three advisories, so set a hotfix window of days, given the 35 day interval and 3 day federal deadlines. If any client ran a July or September affected build while exposed, do the forensic step, since the July notice asks for it on top of the upgrade. Check extraweb_access.log for /__api__/login and /__api__/logout with status 200, /wsproxy with suspicious host parameters and status 101, ctrl-service.log for hotfix removal with a path traversal name, and /var/lib/unit/conf.json for those routes. If you find them, SonicWall says to re-image or re-deploy, change all passwords and reset TOTP. Restore only configuration backups that predate the December hotfix builds, 12.4.3-03245 and 12.5.0-02283.

SMA 100: get it off the network. Pull a list of any SMA 200, 400, 210, 410 or 500v under management now. Firmware 10.2.2.4-94sv keeps licenses working and is not a security update, so do not record it as patching in a client report.

GMS: plan removal this quarter. The August fix was GMS 9.5.2. The November advisory lists 9.5.2 and earlier as affected, with no fix. CVE-2026-109593 needs no login. If a client still runs GMS, cut it off from the internet today and move it. SonicWall’s advisory gives no workaround, so the isolation step is our suggestion. NSM on-premises needs 4.4.0, and SonicWall says NSM SaaS is unaffected by both 2026 NSM advisories.

Firewalls: the April fix is the baseline. SonicOS has 9 CVEs and no KEV entry this year, but SonicWall’s April 29 notice calls firmware 8.2.0-8009, 7.3.2-7010 and 6.5.5.2-28n required, and says Auto Update will remediate customers who have it on. Verify rather than assume. Its stopgap for CVE-2026-0204 is disabling HTTP and HTTPS management and SSL VPN on all interfaces, restricting management to SSH, which would cut remote users off, so have the outage notice ready. For SNWLID-2026-0009, Gen 6 and Gen 7 rely on enabling Enforce HTTP Host Header Check.

Cloud backup: close the ticket properly. Open Issue List in each MySonicWall tenant and record the priority tier for every serial. Reset every credential on a listed firewall. Be careful with any preference file made before September 17, 2025, including during a migration, because SonicWall warns that restoring one brings the exposure with it. SonicWall’s Remediation Playbook also requires changes off the box: IPSec shared secrets on remote gateways and the LDAP bind password on the directory server, so schedule tunnel downtime with the peer’s owner.

Gen 6 migrations: reset local passwords. SonicWall tied many of the 2025 incidents to passwords carried across migration. Its fix is SonicOS 7.3 or later, resetting local SSLVPN passwords, and turning on Botnet Filtering and Account Lockout.

Watch both SonicWall channels. The PSIRT RSS feed carries the CVE data, and product notices spell out what to do and how firmly SonicWall states exploitation. Monitor both, since the notice is where SonicWall sets out steps such as re-imaging. Our zero-day tracker shows why edge devices deserve this attention.

Frequently asked questions

What is the new SonicWall vulnerability?

The newest PSIRT advisory as of November 5, 2026 is SNWLID-2026-0019, published November 3. It covers CVE-2026-109593 (CVSS 9.1, unauthenticated file read) and CVE-2026-109594 (6.8) in end-of-life GMS 9.5.2 and earlier, and SonicWall says no fix is available. The newest critical flaw on a supported product is CVE-2026-102255 (CVSS 10.0) in SMA 1000, from October 6.

Is SonicWall having issues?

The 2026 count is high. SonicWall has published 42 CVEs from January 1 to November 5, the most for that window since at least 2019, compared with 27 in 2025. 12 of them affect SMA 1000, which took all 4 KEV entries this year. SonicOS firewalls had 9 CVEs and no KEV entry in 2026.

Has SonicWall been hacked?

Yes, in one documented case. SonicWall says an unauthorized party accessed firewall configuration backup files for all customers who used its cloud backup service, and its November 4, 2025 blog attributes that to a state-sponsored actor using an API call. It says products, firmware, source code and customer networks were not compromised.

Is SonicWall still owned by Dell?

No. SonicWall’s November 1, 2016 press release says Francisco Partners and Elliott Management completed their purchase of Dell Software Group and spun SonicWall out as an independent security company. We did not check for ownership changes after that release.

Is the SonicWall SMA 100 end of life?

Yes. SonicWall’s lifecycle table shows end of support on June 18, 2025 for SMA 200 and 400, and November 1, 2025 for SMA 210, 410 and 500v. A knowledge base article updated August 11, 2026 says firmware 10.2.2.4-94sv is only for License Manager compatibility, with no other updates.

Which SonicWall vulnerabilities are being exploited in 2026?

CISA KEV lists 4 added in 2026: CVE-2026-15409 and CVE-2026-15410 on July 14, and CVE-2026-83548 and CVE-2026-83549 on September 2, all in SMA 1000 with 3 day deadlines. SecurityWeek reported exploitation attempts on CVE-2026-102255 from October 8, but SonicWall’s notice says no evidence of exploitation, and it was not in KEV on November 4.

Methodology

References

1. SonicWall PSIRT, Security Advisories and RSS feed. Accessed November 2026.
2. SNWLID-2026-0019, End-of-Life GMS. Accessed November 2026.
3. SNWLID-2026-0017, SMA1000, SNWLID-2026-0016 and SNWLID-2026-0008. Accessed November 2026.
4. SonicWall, SMA 1000 notice, July 14, 2026. Accessed November 2026.
5. SonicWall, SMA 1000 notice, September 1, 2026. Accessed November 2026.
6. SonicWall, SMA 1000 notice, October 2026. Accessed November 2026.
7. SonicWall, Firmware Update Required, April 29, 2026. Accessed November 2026.
8. SonicWall, PHP vulnerabilities notice. Accessed November 2026.
9. SonicWall, MySonicWall Cloud Backup File Incident. Accessed November 2026.
10. SonicWall, Cloud Backup Security Incident Investigation Complete. Accessed November 2026.
11. SonicWall, Migration Tool and Remediation Playbook. Accessed November 2026.
12. SonicWall, Gen 7 SSLVPN Recent Threat Activity. Accessed November 2026.
13. SonicWall, Product Life Cycle Tables, SMA. Accessed November 2026.
14. SonicWall, SMA100 10.2.2.4 release. Accessed November 2026.
15. SonicWall, Spin Out from Dell Software Group, November 1, 2016. Accessed November 2026.
16. CISA, Known Exploited Vulnerabilities Catalog. Accessed November 2026.
17. CISA, AA24-109A, #StopRansomware: Akira. Accessed November 2026.
18. CISA, SonicWall Releases Advisory for Customers after Security Incident. Accessed November 2026.
19. CISA, BOD 26-04. Accessed November 2026.
20. NIST NVD API 2.0. Accessed November 2026.
21. SecurityWeek, Critical SonicWall Vulnerability Exploited Days After Disclosure, cited for third-party reports only. Accessed November 2026.