{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T16:42:00.965Z",
  "tag": {
    "id": "sonicwall",
    "label": "SonicWall",
    "isStack": false,
    "url": "https://pwn.watch/t/sonicwall",
    "feed": "https://pwn.watch/t/sonicwall/feed.xml"
  },
  "counts": {
    "incidents": 9,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 9
  },
  "incidents": [
    {
      "slug": "sonicwall-sma1000-appliances-cve-2026-83548",
      "title": "SonicWall SMA1000 Appliances: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability",
      "url": "https://pwn.watch/i/sonicwall-sma1000-appliances-cve-2026-83548",
      "json": "https://pwn.watch/i/sonicwall-sma1000-appliances-cve-2026-83548.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "SonicWall SMA1000 Appliances",
      "tags": [
        "sonicwall",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-83548",
        "CVE-2026-83549"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-02",
      "closedAt": "2026-09-02",
      "updatedAt": "2026-09-02",
      "summary": "SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations. CISA added CVE-2026-83548, CVE-2026-83549 to the Known Exploited Vulnerabilities catalog on 2026-09-02 based on evidence of active exploitation.",
      "xPost": null
    },
    {
      "slug": "sonicwall-sma1000-appliances-cve-2026-15409",
      "title": "SonicWall SMA1000 Appliances: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability",
      "url": "https://pwn.watch/i/sonicwall-sma1000-appliances-cve-2026-15409",
      "json": "https://pwn.watch/i/sonicwall-sma1000-appliances-cve-2026-15409.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "SonicWall SMA1000 Appliances",
      "tags": [
        "sonicwall",
        "ransomware",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-15409",
        "CVE-2026-15410"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-07-14",
      "closedAt": "2026-07-14",
      "updatedAt": "2026-07-14",
      "summary": "SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location. CISA added CVE-2026-15409, CVE-2026-15410 to the Known Exploited Vulnerabilities catalog on 2026-07-14 based on evidence of active exploitation.",
      "xPost": null
    },
    {
      "slug": "sonicwall-sma1000-appliance-cve-2025-40602",
      "title": "SonicWall SMA1000 appliance: SMA1000 Missing Authorization Vulnerability",
      "url": "https://pwn.watch/i/sonicwall-sma1000-appliance-cve-2025-40602",
      "json": "https://pwn.watch/i/sonicwall-sma1000-appliance-cve-2025-40602.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "SonicWall SMA1000 appliance",
      "tags": [
        "sonicwall",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-40602"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-12-17",
      "closedAt": "2025-12-17",
      "updatedAt": "2025-12-17",
      "summary": "SonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console (AMC) of affected devices. Added to CISA KEV on 2025-12-17.",
      "xPost": null
    },
    {
      "slug": "sonicwall-mysonicwall-cloud-backup-breach-2025",
      "title": "SonicWall: state actor stole firewall config backups of every cloud-backup customer",
      "url": "https://pwn.watch/i/sonicwall-mysonicwall-cloud-backup-breach-2025",
      "json": "https://pwn.watch/i/sonicwall-mysonicwall-cloud-backup-breach-2025.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "SonicWall MySonicWall cloud backup",
      "tags": [
        "sonicwall",
        "nation-state",
        "data-breach"
      ],
      "cveIds": [],
      "affectedVersions": [
        "n/a"
      ],
      "fixedVersions": [],
      "startedAt": "2025-09-17",
      "closedAt": "2025-11-05",
      "updatedAt": "2025-11-05",
      "summary": "SonicWall and Mandiant confirmed that a state-sponsored actor used an API call to pull firewall configuration backup files for all customers using MySonicWall cloud backup, after first saying fewer than 5% were affected. The files include credentials and network details, so customers had to reset firewall, VPN, directory and API secrets.",
      "xPost": null
    },
    {
      "slug": "sonicwall-sma100-appliances-cve-2023-44221",
      "title": "SonicWall SMA100 Appliances: SMA100 Appliances OS Command Injection Vulnerability",
      "url": "https://pwn.watch/i/sonicwall-sma100-appliances-cve-2023-44221",
      "json": "https://pwn.watch/i/sonicwall-sma100-appliances-cve-2023-44221.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "SonicWall SMA100 Appliances",
      "tags": [
        "sonicwall",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2023-44221"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-05-01",
      "closedAt": "2025-05-01",
      "updatedAt": "2025-05-01",
      "summary": "SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user. Added to CISA KEV on 2025-05-01.",
      "xPost": null
    },
    {
      "slug": "sonicwall-sma100-appliances-cve-2021-20035",
      "title": "SonicWall SMA100 Appliances: SMA100 Appliances OS Command Injection Vulnerability",
      "url": "https://pwn.watch/i/sonicwall-sma100-appliances-cve-2021-20035",
      "json": "https://pwn.watch/i/sonicwall-sma100-appliances-cve-2021-20035.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "SonicWall SMA100 Appliances",
      "tags": [
        "sonicwall",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2021-20035"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-04-16",
      "closedAt": "2025-04-16",
      "updatedAt": "2025-04-16",
      "summary": "SonicWall SMA100 appliances contain an OS command injection vulnerability in the management interface that allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user, which could potentially lead to code execution. Added to CISA KEV on 2025-04-16.",
      "xPost": null
    },
    {
      "slug": "sonicwall-sonicos-cve-2024-53704",
      "title": "SonicWall SonicOS: SonicOS SSLVPN Improper Authentication Vulnerability",
      "url": "https://pwn.watch/i/sonicwall-sonicos-cve-2024-53704",
      "json": "https://pwn.watch/i/sonicwall-sonicos-cve-2024-53704.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "SonicWall SonicOS",
      "tags": [
        "sonicwall",
        "ransomware",
        "cisa-kev",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2024-53704"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-02-18",
      "closedAt": "2025-02-18",
      "updatedAt": "2025-02-18",
      "summary": "SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication. Added to CISA KEV on 2025-02-18.",
      "xPost": null
    },
    {
      "slug": "sonicwall-sma1000-appliances-cve-2025-23006",
      "title": "SonicWall SMA1000 Appliances: SMA1000 Appliances Deserialization Vulnerability",
      "url": "https://pwn.watch/i/sonicwall-sma1000-appliances-cve-2025-23006",
      "json": "https://pwn.watch/i/sonicwall-sma1000-appliances-cve-2025-23006.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "SonicWall SMA1000 Appliances",
      "tags": [
        "sonicwall",
        "ransomware",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-23006"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-01-24",
      "closedAt": "2025-01-24",
      "updatedAt": "2025-01-24",
      "summary": "SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands. Added to CISA KEV on 2025-01-24.",
      "xPost": null
    },
    {
      "slug": "sonicwall-sonicos-cve-2024-40766",
      "title": "SonicWall SonicOS Improper Access Control",
      "url": "https://pwn.watch/i/sonicwall-sonicos-cve-2024-40766",
      "json": "https://pwn.watch/i/sonicwall-sonicos-cve-2024-40766.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "SonicWall SonicOS",
      "tags": [
        "sonicwall",
        "sonicos",
        "cisa-kev",
        "ransomware"
      ],
      "cveIds": [
        "CVE-2024-40766"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-08-23",
      "closedAt": "2024-09-09",
      "updatedAt": "2024-09-09",
      "summary": "SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash. Added to the CISA KEV catalog on 2024-09-09. CISA lists known use in ransomware campaigns.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "sonicwall-sma1000-appliances-cve-2026-83548",
      "incidentTitle": "SonicWall SMA1000 Appliances: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-02",
      "title": "CISA added CVE-2026-83548, CVE-2026-83549 to the KEV catalog (due 2026-09-05).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/sonicwall-sma1000-appliances-cve-2026-83548"
    },
    {
      "incident": "sonicwall-sma1000-appliances-cve-2026-15409",
      "incidentTitle": "SonicWall SMA1000 Appliances: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-07-14",
      "title": "CISA added CVE-2026-15409, CVE-2026-15410 to the KEV catalog (due 2026-07-17).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/sonicwall-sma1000-appliances-cve-2026-15409"
    },
    {
      "incident": "sonicwall-sma1000-appliance-cve-2025-40602",
      "incidentTitle": "SonicWall SMA1000 appliance: SMA1000 Missing Authorization Vulnerability",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-12-17",
      "title": "CISA added CVE-2025-40602 to the KEV catalog (due 2025-12-24).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/sonicwall-sma1000-appliance-cve-2025-40602"
    },
    {
      "incident": "sonicwall-mysonicwall-cloud-backup-breach-2025",
      "incidentTitle": "SonicWall: state actor stole firewall config backups of every cloud-backup customer",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-11",
      "title": "SonicWall says the investigation is complete and attributes it to a state-sponsored actor",
      "body": null,
      "sourceUrl": "https://www.sonicwall.com/blog/cloud-backup-security-incident-investigation-complete-and-strengthened-cyber-resilience",
      "url": "https://pwn.watch/i/sonicwall-mysonicwall-cloud-backup-breach-2025"
    },
    {
      "incident": "sonicwall-mysonicwall-cloud-backup-breach-2025",
      "incidentTitle": "SonicWall: state actor stole firewall config backups of every cloud-backup customer",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-10-08",
      "title": "SonicWall and Mandiant confirm all cloud-backup customers' files were accessed",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/sonicwall-firewall-configs-stolen-for-all-cloud-backup-customers/",
      "url": "https://pwn.watch/i/sonicwall-mysonicwall-cloud-backup-breach-2025"
    },
    {
      "incident": "sonicwall-mysonicwall-cloud-backup-breach-2025",
      "incidentTitle": "SonicWall: state actor stole firewall config backups of every cloud-backup customer",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-09-17",
      "title": "SonicWall discloses unauthorized access to cloud backup files (initially <5% of customers)",
      "body": null,
      "sourceUrl": "https://www.sonicwall.com/support/notices/mysonicwall-cloud-backup-file-incident/kA1VN0000000RoD0AU",
      "url": "https://pwn.watch/i/sonicwall-mysonicwall-cloud-backup-breach-2025"
    },
    {
      "incident": "sonicwall-sma100-appliances-cve-2023-44221",
      "incidentTitle": "SonicWall SMA100 Appliances: SMA100 Appliances OS Command Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-05-01",
      "title": "CISA added CVE-2023-44221 to the KEV catalog (due 2025-05-22).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/sonicwall-sma100-appliances-cve-2023-44221"
    },
    {
      "incident": "sonicwall-sma100-appliances-cve-2021-20035",
      "incidentTitle": "SonicWall SMA100 Appliances: SMA100 Appliances OS Command Injection Vulnerability",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-04-16",
      "title": "CISA added CVE-2021-20035 to the KEV catalog (due 2025-05-07).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/sonicwall-sma100-appliances-cve-2021-20035"
    },
    {
      "incident": "sonicwall-sonicos-cve-2024-53704",
      "incidentTitle": "SonicWall SonicOS: SonicOS SSLVPN Improper Authentication Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-02-18",
      "title": "CISA added CVE-2024-53704 to the KEV catalog (due 2025-03-11).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/sonicwall-sonicos-cve-2024-53704"
    },
    {
      "incident": "sonicwall-sma1000-appliances-cve-2025-23006",
      "incidentTitle": "SonicWall SMA1000 Appliances: SMA1000 Appliances Deserialization Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-01-24",
      "title": "CISA added CVE-2025-23006 to the KEV catalog (due 2025-02-14).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/sonicwall-sma1000-appliances-cve-2025-23006"
    },
    {
      "incident": "sonicwall-sonicos-cve-2024-40766",
      "incidentTitle": "SonicWall SonicOS Improper Access Control",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-09-09",
      "title": "CISA added CVE-2024-40766 to the KEV catalog (federal deadline 2024-09-30)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/sonicwall-sonicos-cve-2024-40766"
    },
    {
      "incident": "sonicwall-sonicos-cve-2024-40766",
      "incidentTitle": "SonicWall SonicOS Improper Access Control",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-08-23",
      "title": "CVE-2024-40766 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-40766",
      "url": "https://pwn.watch/i/sonicwall-sonicos-cve-2024-40766"
    }
  ]
}