The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
14 Jul 2026 SonicWall SMA1000 Appliances Remote code execution
Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 17 Jul 2026
- Weakness
- CWE-94
14 Jul 2026 SonicWall SMA1000 Appliances Server-side request forgery
A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 17 Jul 2026
- Weakness
- CWE-918
On Hacker News
CVE-2026-15409: SonicWall SMA 1000 SSRF Zero-Day18 Feb 2025 SonicWall SonicOS Authentication bypass
An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 11 Mar 2025
- Weakness
- CWE-287
24 Jan 2025 SonicWall SMA1000 Appliances Remote code execution
Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- sonicwall sma8200v 12.4.3-02854, sonicwall sma7210 firmware 12.4.3-02854, sonicwall sma7200 firmware 12.4.3-02854, sonicwall sma6210 firmware 12.4.3-02854, sonicwall sma6200 firmware 12.4.3-02854
- CISA due date
- 14 Feb 2025
- Weakness
- CWE-502
9 Sep 2024 SonicWall SonicOS Access control flaw
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- sonicwall sonicos 6.5.4.15.116n, sonicwall sonicos 6.5.2.8-2n, sonicwall sonicos 5.9.2.14-13o
- CISA due date
- 30 Sep 2024
- Weakness
- CWE-284
28 Mar 2022 SonicWall Secure Remote Access (SRA) SQL injection
Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- sonicwall sra 4600 firmware 9.0.0.10-28sv, sonicwall sra 1600 firmware 9.0.0.10-28sv, sonicwall sma 500v firmware 9.0.0.10-28sv, sonicwall sma 410 firmware 9.0.0.10-28sv, sonicwall sma 210 firmware 9.0.0.10-28sv and 1 older
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-89
15 Mar 2022 SonicWall SonicOS Memory corruption
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. This vulnerability affected SonicOS Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 5 Apr 2022
- Weakness
- CWE-120
28 Jan 2022 SonicWall SMA 100 Appliances Memory corruption
A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 11 Feb 2022
- Weakness
- CWE-121
3 Nov 2021 SonicWall Email Security Path traversal
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- sonicwall email security appliance 9000 firmware 10.0.9.6177, sonicwall email security appliance 8300 firmware 10.0.9.6177, sonicwall email security appliance 7050 firmware 10.0.9.6177, sonicwall email security appliance 7000 firmware 10.0.9.6177, sonicwall email security appliance 5050 firmware 10.0.9.6177 and 6 older
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-22
3 Nov 2021 SonicWall Email Security Malicious file upload
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- sonicwall email security appliance 9000 firmware 10.0.9.6105, sonicwall email security appliance 8300 firmware 10.0.9.6105, sonicwall email security appliance 7050 firmware 10.0.9.6105, sonicwall email security appliance 7000 firmware 10.0.9.6105, sonicwall email security appliance 5050 firmware 10.0.9.6105 and 6 older
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-434
3 Nov 2021 SonicWall Email Security Privilege escalation
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- sonicwall email security appliance 9000 firmware 10.0.9.6105, sonicwall email security appliance 8300 firmware 10.0.9.6105, sonicwall email security appliance 7050 firmware 10.0.9.6105, sonicwall email security appliance 7000 firmware 10.0.9.6105, sonicwall email security appliance 5050 firmware 10.0.9.6105 and 6 older
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-306
3 Nov 2021 SonicWall SSLVPN SMA100 SQL injection
A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- sonicwall sma 100 firmware 10.2.0.5-d-29sv
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-89
3 Nov 2021 SonicWall SMA100 SQL injection
Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This vulnerablity impacted SMA100 version 9.0.0.3 and earlier.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- sonicwall sma 100 firmware 9.0.0.4
- CISA due date
- 3 May 2022
- Weakness
- CWE-89
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.