The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
6 Nov 2026 SonicWall SonicOS SSLVPN Security flaw
An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- sonicwall sonicos 8.2.2-8015, sonicwall sonicos 7.3.4-7015
- CISA due date
- 20 Nov 2026 (still open)
- Weakness
- CWE-308
On Hacker News
SonicWall SonicOS SSLVPN auth bypass (CVE-2026-19868)2 Sep 2026 SonicWall SMA1000 Appliances Command injection
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- sonicwall sma8200v 12.5.0-02952, sonicwall sma8200v 12.4.3-03526, sonicwall sma7210 firmware 12.5.0-02952, sonicwall sma7210 firmware 12.4.3-03526, sonicwall sma6210 firmware 12.5.0-02952 and 1 older
- CISA due date
- 5 Sep 2026
- Weakness
- CWE-78
2 Sep 2026 SonicWall SMA1000 Appliances Server-side request forgery
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- sonicwall sma8200v 12.5.0-02952, sonicwall sma8200v 12.4.3-03526, sonicwall sma7210 firmware 12.5.0-02952, sonicwall sma7210 firmware 12.4.3-03526, sonicwall sma6210 firmware 12.5.0-02952 and 1 older
- CISA due date
- 5 Sep 2026
- Weakness
- CWE-918, CWE-441
14 Jul 2026 SonicWall SMA1000 Appliances Remote code execution
Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 17 Jul 2026
- Weakness
- CWE-94
14 Jul 2026 SonicWall SMA1000 Appliances Server-side request forgery
A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 17 Jul 2026
- Weakness
- CWE-918
On Hacker News
CVE-2026-15409: SonicWall SMA 1000 SSRF Zero-Day17 Dec 2025 SonicWall SMA1000 appliance Access control flaw
A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- sonicwall sma8200v 12.5.0-02283, sonicwall sma8200v 12.4.3-03245, sonicwall sma7210 firmware 12.5.0-02283, sonicwall sma7210 firmware 12.4.3-03245, sonicwall sma7200 firmware 12.5.0-02283 and 5 older
- CISA due date
- 24 Dec 2025
- Weakness
- CWE-862, CWE-250
1 May 2025 Apache HTTP Server Input validation flaw
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- sonicwall sma 500v firmware 10.2.1.14-75sv, sonicwall sma 410 firmware 10.2.1.14-75sv, sonicwall sma 400 firmware 10.2.1.14-75sv, sonicwall sma 210 firmware 10.2.1.14-75sv, sonicwall sma 200 firmware 10.2.1.14-75sv and 1 older
- CISA due date
- 22 May 2025
- Weakness
- CWE-116
1 May 2025 SonicWall SMA100 Appliances Command injection
Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 22 May 2025
- Weakness
- CWE-78
16 Apr 2025 SonicWall SMA100 Appliances Command injection
Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- sonicwall sma 410 firmware 10.2.1.1-19sv, sonicwall sma 410 firmware 10.2.0.8-37sv, sonicwall sma 410 firmware 9.0.0.11-31sv, sonicwall sma 400 firmware 10.2.1.1-19sv, sonicwall sma 400 firmware 10.2.0.8-37sv and 7 older
- CISA due date
- 7 May 2025
- Weakness
- CWE-78
18 Feb 2025 SonicWall SonicOS Authentication bypass
An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 11 Mar 2025
- Weakness
- CWE-287
24 Jan 2025 SonicWall SMA1000 Appliances Remote code execution
Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- sonicwall sma8200v 12.4.3-02854, sonicwall sma7210 firmware 12.4.3-02854, sonicwall sma7200 firmware 12.4.3-02854, sonicwall sma6210 firmware 12.4.3-02854, sonicwall sma6200 firmware 12.4.3-02854
- CISA due date
- 14 Feb 2025
- Weakness
- CWE-502
9 Sep 2024 SonicWall SonicOS Access control flaw
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- sonicwall sonicos 6.5.4.15.116n, sonicwall sonicos 6.5.2.8-2n, sonicwall sonicos 5.9.2.14-13o
- CISA due date
- 30 Sep 2024
- Weakness
- CWE-284
28 Mar 2022 SonicWall Secure Remote Access (SRA) SQL injection
Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- sonicwall sra 4600 firmware 9.0.0.10-28sv, sonicwall sra 1600 firmware 9.0.0.10-28sv, sonicwall sma 500v firmware 9.0.0.10-28sv, sonicwall sma 410 firmware 9.0.0.10-28sv, sonicwall sma 210 firmware 9.0.0.10-28sv and 1 older
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-89
28 Mar 2022 SonicWall SMA100 Path traversal
In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- sonicwall sma 100 firmware 9.0.0.4
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-22
15 Mar 2022 SonicWall SonicOS Memory corruption
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. This vulnerability affected SonicOS Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 5 Apr 2022
- Weakness
- CWE-120
28 Jan 2022 SonicWall SMA 100 Appliances Memory corruption
A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 11 Feb 2022
- Weakness
- CWE-121
3 Nov 2021 SonicWall Email Security Path traversal
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- sonicwall email security appliance 9000 firmware 10.0.9.6177, sonicwall email security appliance 8300 firmware 10.0.9.6177, sonicwall email security appliance 7050 firmware 10.0.9.6177, sonicwall email security appliance 7000 firmware 10.0.9.6177, sonicwall email security appliance 5050 firmware 10.0.9.6177 and 6 older
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-22
3 Nov 2021 SonicWall Email Security Malicious file upload
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- sonicwall email security appliance 9000 firmware 10.0.9.6105, sonicwall email security appliance 8300 firmware 10.0.9.6105, sonicwall email security appliance 7050 firmware 10.0.9.6105, sonicwall email security appliance 7000 firmware 10.0.9.6105, sonicwall email security appliance 5050 firmware 10.0.9.6105 and 6 older
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-434
3 Nov 2021 SonicWall Email Security Privilege escalation
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- sonicwall email security appliance 9000 firmware 10.0.9.6105, sonicwall email security appliance 8300 firmware 10.0.9.6105, sonicwall email security appliance 7050 firmware 10.0.9.6105, sonicwall email security appliance 7000 firmware 10.0.9.6105, sonicwall email security appliance 5050 firmware 10.0.9.6105 and 6 older
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-306
3 Nov 2021 SonicWall SSLVPN SMA100 SQL injection
A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- sonicwall sma 100 firmware 10.2.0.5-d-29sv
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-89
3 Nov 2021 SonicWall SMA100 SQL injection
Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This vulnerablity impacted SMA100 version 9.0.0.3 and earlier.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- sonicwall sma 100 firmware 9.0.0.4
- CISA due date
- 3 May 2022
- Weakness
- CWE-89
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.