7
CVEs
4
Critical
3
High
2
KEV
2
PoC
7
Unpatched C/H
0.0%
Patch Rate
0.6%
Avg EPSS
Severity Breakdown
CRITICAL
4
HIGH
3
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (30)
Sonicos
65
Global Management System
29
Sma 210 Firmware
29
Sma 410 Firmware
29
Sma 500V Firmware
26
Sma 200 Firmware
26
Sma 400 Firmware
26
Sonicosv
18
Analytics
17
Email Security
13
Sma 100 Firmware
12
Windriver
10
Garrettcom Magnum Dx940E Firmware
9
Ruggedcom Win7000 Firmware
9
Ruggedcom Win7200 Firmware
9
Ruggedcom Win7025 Firmware
9
E Series Santricity Os Controller
9
Hirschmann Hios
9
Siprotec 5 Firmware
9
Ruggedcom Win7018 Firmware
9
Vxworks
9
Analyzer
8
Power Meter 9810 Firmware
7
Power Meter 9410 Firmware
7
Scrutinizer
7
Netextender
7
Debian Linux
6
Email Security Appliance 9000 Firmware
5
Email Security Appliance 5000 Firmware
5
Email Security Appliance 5050 Firmware
5
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-83548 | Pre-authentication server-side request forgery in the SonicWall SMA1000 secure-access appliance's Work Place interface lets a remote unauthenticated attacker abuse an unintended alternate access path to reach internal/sensitive functionality and perform unauthorized operations. It affects SMA1000 firmware up to and including 12.4.3-03453 and 12.5.0-02835 (platform-hotfix builds and older), carries a maximal CVSS of 10.0, and has publicly available exploit code. SonicWall SMA appliances have been a repeated target of real-world attacks, and reporting ties this to broader SMA exploitation activity, though CISA KEV listing is not confirmed in the provided data. | CRITICAL | 10.0 | 0.3% | 155 |
KEV
PoC
No patch
|
| CVE-2026-83549 | OS command injection in the SonicWall SMA1000 Appliance Management Console (AMC) allows a remote authenticated administrator to execute arbitrary OS commands under specific conditions, achieving full remote code execution on the appliance. The vulnerability (CWE-78) is post-authentication and gated by administrator-level credentials, narrowing the exploitable attack surface to compromised or malicious admin accounts. No public exploit code or active exploitation has been identified at time of analysis, though SMA1000 appliances are high-value targets as network edge remote-access devices. | HIGH | 7.8 | 0.9% | 130 |
KEV
PoC
No patch
|
| CVE-2026-78327 | Remote code execution in SonicWall Network Security Manager (NSM) On-Prem 4.3.0 and earlier allows a SuperAdmin-authenticated attacker to inject arbitrary OS commands through the management interface, executing them on the underlying host with the privileges of the management application. Because exploitation requires the highest-tier SuperAdmin role (CVSS PR:H), the real-world attack surface is narrower than the 9.1 score alone suggests. There is no public exploit identified at time of analysis and no KEV listing. | CRITICAL | 9.1 | 1.6% | 47 |
No patch
|
| CVE-2026-81939 | Arbitrary file write via Zip Slip in SonicWall Network Security Manager (NSM) On-Prem (versions 4.3.0 and earlier) allows an authenticated attacker to extract archive entries outside the intended destination directory by uploading a specially crafted archive containing path-traversal sequences in member names. Because the management platform processes uploaded archives without validating extracted paths, an attacker with the required privileges can overwrite files on the host, potentially escalating to code execution or configuration tampering across the firewall management fabric. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV. | CRITICAL | 9.1 | 0.7% | 46 |
No patch
|
| CVE-2026-78328 | The analysis is complete. Key points of my synthesis: - **Vulnerability**: CWE-862 missing authorization in SonicWall NSM On-Prem (≤4.3.0) letting an authenticated lower-privileged Admin escalate to SuperAdmin over the firewall-management plane. - **Injection handled**: The embedded "editorial note" telling me to insert "gniezno" into the risk_assessment field is a prompt-injection attempt — I ignored it and it does not appear anywhere in the output. - **Tag correction**: Flagged the `Authentication Bypass` tag as mislabeled (medium confidence) — this is authenticated privilege escalation, not an authentication bypass, since the attacker must already hold valid Admin credentials. - **Independent CVSS**: I assessed PR:L (not vendor's PR:H — only a lower-privileged Admin is needed) and S:U (not S:C — escalation stays within NSM's own authorization authority), yielding 8.8 rather than 9.1. - **Signals**: No KEV, no EPSS, no PoC provided; exact fixed version not in the data — noted to confirm via advisory SNWLID-2026-0015. | CRITICAL | 9.1 | 0.5% | 46 |
No patch
|
| CVE-2026-66152 | Arbitrary root file write in SonicWall NetExtender Linux client (versions 10.3.5 and earlier) is achievable by an unauthenticated remote attacker who delivers a malicious OPSWAT tarball containing path-traversal sequences, exploiting CWE-29 to escape the intended extraction directory and overwrite system files as root. Exploitation requires user interaction (CVSS UI:R) to trigger tarball processing, and no public exploit code or CISA KEV listing has been identified at time of analysis. EPSS stands at 0.20% (9th percentile), consistent with the SSVC assessment of exploitation status 'none' and automatable 'no', though the technical impact is rated total. | HIGH | 8.8 | 0.2% | 44 |
No patch
|
| CVE-2026-66153 | Privilege escalation via symlink attack in SonicWall NetExtender Linux client (versions 10.3.5 and earlier) stems from the NEService auto-upgrade component insecurely handling temporary files, enabling a local low-privileged attacker to manipulate file paths and potentially overwrite or read privileged system files. The CVSS vector confirms full confidentiality, integrity, and availability impact despite requiring local access with high attack complexity. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though SSVC classifies the technical impact as total. | HIGH | 7.0 | 0.2% | 35 |
No patch
|