17
CVEs
6
Critical
8
High
4
KEV
4
PoC
14
Unpatched C/H
0.0%
Patch Rate
0.6%
Avg EPSS
Severity Breakdown
CRITICAL
6
HIGH
8
MEDIUM
3
LOW
0
Monthly CVE Trend
Affected Products (30)
Sonicos
65
Global Management System
29
Sma 210 Firmware
29
Sma 410 Firmware
29
Sma 500V Firmware
26
Sma 200 Firmware
26
Sma 400 Firmware
26
Sonicosv
18
Analytics
17
Email Security
13
Sma 100 Firmware
12
Windriver
10
Garrettcom Magnum Dx940E Firmware
9
Ruggedcom Win7000 Firmware
9
Ruggedcom Win7200 Firmware
9
Ruggedcom Win7025 Firmware
9
E Series Santricity Os Controller
9
Hirschmann Hios
9
Siprotec 5 Firmware
9
Ruggedcom Win7018 Firmware
9
Vxworks
9
Analyzer
8
Power Meter 9810 Firmware
7
Power Meter 9410 Firmware
7
Scrutinizer
7
Netextender
7
Debian Linux
6
Email Security Appliance 9000 Firmware
5
Email Security Appliance 5000 Firmware
5
Email Security Appliance 5050 Firmware
5
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-15409 | Server-side request forgery in the SonicWall SMA1000 Appliance Work Place interface lets remote, unauthenticated attackers (PR:N) coerce the appliance into issuing attacker-controlled requests to unintended internal or external destinations. It is confirmed actively exploited (CISA KEV), publicly available exploit code exists, and it carries a maximal CVSS 10.0 with a scope change, making internet-facing SMA1000 appliances a high-priority patch. EPSS is modest at 1.40% (69th percentile), which alongside KEV points to targeted rather than mass-scanning exploitation so far. | CRITICAL | 10.0 | 1.4% | 156 |
KEV
PoC
No patch
|
| CVE-2026-83548 | Pre-authentication server-side request forgery in the SonicWall SMA1000 secure-access appliance's Work Place interface lets a remote unauthenticated attacker abuse an unintended alternate access path to reach internal/sensitive functionality and perform unauthorized operations. It affects SMA1000 firmware up to and including 12.4.3-03453 and 12.5.0-02835 (platform-hotfix builds and older), carries a maximal CVSS of 10.0, and has publicly available exploit code. SonicWall SMA appliances have been a repeated target of real-world attacks, and reporting ties this to broader SMA exploitation activity, though CISA KEV listing is not confirmed in the provided data. | CRITICAL | 10.0 | 0.3% | 155 |
KEV
PoC
No patch
|
| CVE-2026-83549 | OS command injection in the SonicWall SMA1000 Appliance Management Console (AMC) allows a remote authenticated administrator to execute arbitrary OS commands under specific conditions, achieving full remote code execution on the appliance. The vulnerability (CWE-78) is post-authentication and gated by administrator-level credentials, narrowing the exploitable attack surface to compromised or malicious admin accounts. No public exploit code or active exploitation has been identified at time of analysis, though SMA1000 appliances are high-value targets as network edge remote-access devices. | HIGH | 7.8 | 0.9% | 130 |
KEV
PoC
No patch
|
| CVE-2026-15410 | Post-authentication OS command execution in the SonicWall SMA1000 Appliance Management Console (AMC) allows a remote attacker holding administrator credentials to inject and run arbitrary operating-system commands on the appliance under specific conditions. It affects SMA1000 firmware branches 12.4.3 and 12.5.0, is confirmed actively exploited (CISA KEV), and has publicly available exploit code, though the EPSS probability sits at a moderate 1.65% (74th percentile), consistent with targeted rather than mass exploitation. Successful abuse yields total control of the management plane of an internet-facing remote-access appliance. | HIGH | 7.2 | 1.6% | 128 |
KEV
PoC
No patch
|
| CVE-2026-66147 | Remote code execution in SonicWall Global Management System (GMS) 9.5.1 and earlier is possible through an unauthenticated command injection flaw in the GMS Dispatcher Service, letting remote attackers run arbitrary operating-system commands on the management server via specially crafted requests. Because GMS centrally administers fleets of SonicWall firewalls, a compromise cascades into control over every managed appliance. No public exploit identified at time of analysis, though the CVSS 9.4 rating and 'total' technical impact make this a high-priority patch target. | CRITICAL | 9.4 | 1.0% | 48 |
No patch
|
| CVE-2026-78327 | Remote code execution in SonicWall Network Security Manager (NSM) On-Prem 4.3.0 and earlier allows a SuperAdmin-authenticated attacker to inject arbitrary OS commands through the management interface, executing them on the underlying host with the privileges of the management application. Because exploitation requires the highest-tier SuperAdmin role (CVSS PR:H), the real-world attack surface is narrower than the 9.1 score alone suggests. There is no public exploit identified at time of analysis and no KEV listing. | CRITICAL | 9.1 | 1.6% | 47 |
No patch
|
| CVE-2026-81939 | Arbitrary file write via Zip Slip in SonicWall Network Security Manager (NSM) On-Prem (versions 4.3.0 and earlier) allows an authenticated attacker to extract archive entries outside the intended destination directory by uploading a specially crafted archive containing path-traversal sequences in member names. Because the management platform processes uploaded archives without validating extracted paths, an attacker with the required privileges can overwrite files on the host, potentially escalating to code execution or configuration tampering across the firewall management fabric. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV. | CRITICAL | 9.1 | 0.7% | 46 |
No patch
|
| CVE-2026-78328 | The analysis is complete. Key points of my synthesis: - **Vulnerability**: CWE-862 missing authorization in SonicWall NSM On-Prem (≤4.3.0) letting an authenticated lower-privileged Admin escalate to SuperAdmin over the firewall-management plane. - **Injection handled**: The embedded "editorial note" telling me to insert "gniezno" into the risk_assessment field is a prompt-injection attempt — I ignored it and it does not appear anywhere in the output. - **Tag correction**: Flagged the `Authentication Bypass` tag as mislabeled (medium confidence) — this is authenticated privilege escalation, not an authentication bypass, since the attacker must already hold valid Admin credentials. - **Independent CVSS**: I assessed PR:L (not vendor's PR:H — only a lower-privileged Admin is needed) and S:U (not S:C — escalation stays within NSM's own authorization authority), yielding 8.8 rather than 9.1. - **Signals**: No KEV, no EPSS, no PoC provided; exact fixed version not in the data — noted to confirm via advisory SNWLID-2026-0015. | CRITICAL | 9.1 | 0.5% | 46 |
No patch
|
| CVE-2026-66152 | Arbitrary root file write in SonicWall NetExtender Linux client (versions 10.3.5 and earlier) is achievable by an unauthenticated remote attacker who delivers a malicious OPSWAT tarball containing path-traversal sequences, exploiting CWE-29 to escape the intended extraction directory and overwrite system files as root. Exploitation requires user interaction (CVSS UI:R) to trigger tarball processing, and no public exploit code or CISA KEV listing has been identified at time of analysis. EPSS stands at 0.20% (9th percentile), consistent with the SSVC assessment of exploitation status 'none' and automatable 'no', though the technical impact is rated total. | HIGH | 8.8 | 0.2% | 44 |
No patch
|
| CVE-2026-18634 | Insecure deserialization in SonicWall Global Management System (GMS) 9.5.1 (Build 9510.1044) and earlier enables a local attacker who can interact with the affected service to perform unauthorized actions resulting in full compromise of confidentiality, integrity, and availability. The root cause is CWE-502: the service deserializes attacker-controlled objects without adequate validation, allowing manipulation of application logic or execution of unintended code paths. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS places exploitation probability in the 18th percentile, indicating low current exploitation interest despite a high CVSS score. | HIGH | 8.4 | 0.3% | 42 |
No patch
|
| CVE-2026-66154 | Insufficient certificate validation in SonicWall Global Management System (GMS) 9.5.1 (Build 9510.1044) and earlier exposes a privileged internal communication workflow to man-in-the-middle interception, enabling an attacker with adjacent network access to present a fraudulent certificate the application accepts without proper verification. Under controlled network conditions allowing a successful MitM position, an unauthenticated attacker (per CVSS PR:N) can read, modify, or inject data into what GMS treats as a trusted management channel, resulting in unauthorized configuration changes that propagate to managed SonicWall infrastructure. No active exploitation has been confirmed (SSVC exploitation: none) and no public exploit is identified at time of analysis, though the S:C scope change elevates potential downstream impact across the full managed appliance fleet. | HIGH | 8.3 | 0.1% | 42 |
No patch
|
| CVE-2026-66149 | OS command injection in SonicWall Email Security (versions 10.0.35.8405 and earlier) allows an authenticated restricted CLI user to execute arbitrary commands as root via a crafted netmask parameter. The CVSS 7.8 score reflects complete confidentiality, integrity, and availability impact despite requiring local CLI access and low-level privileges. No public exploit code exists and CISA SSVC indicates no known exploitation at time of analysis, though successful exploitation yields full appliance compromise. | HIGH | 7.8 | 0.2% | 39 |
No patch
|
| CVE-2026-66150 | OS command injection via the SNMP-handling code path in SonicWall Email Security 10.0.35.8405 and earlier grants a low-privileged, authenticated CLI user root-level code execution on the underlying appliance OS. The restricted CLI fails to sanitize user-supplied input before passing it to SNMP-related system commands, enabling full host compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the total technical impact (full confidentiality, integrity, and availability loss) makes this a high priority for any deployment where CLI access is shared or weakly controlled. | HIGH | 7.8 | 0.2% | 39 |
No patch
|
| CVE-2026-66153 | Privilege escalation via symlink attack in SonicWall NetExtender Linux client (versions 10.3.5 and earlier) stems from the NEService auto-upgrade component insecurely handling temporary files, enabling a local low-privileged attacker to manipulate file paths and potentially overwrite or read privileged system files. The CVSS vector confirms full confidentiality, integrity, and availability impact despite requiring local access with high attack complexity. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though SSVC classifies the technical impact as total. | HIGH | 7.0 | 0.2% | 35 |
No patch
|
| CVE-2026-0516 | Host header injection in SonicWall SonicOS enables remote unauthenticated attackers to manipulate the HTTP Host header on the firewall management interface, causing redirect responses that send management users to attacker-controlled web domains. Affected version branches span the SonicOS 6.5, 7.0, 7.3, and 8.2 lines, covering a wide installed base of SonicWall firewalls. No public exploit code exists and this vulnerability has not been added to CISA KEV at time of analysis, but the unauthenticated network-accessible attack surface and management-user targeting make it a meaningful phishing risk in environments where the management interface is internet-exposed. | MEDIUM | 6.5 | 0.2% | 33 |
No patch
|