SonicWall SMA1000 Appliances known exploited vulnerabilities
We track 5 CVEs in SonicWall SMA1000 Appliances. 4 of them are on CISA's Known Exploited Vulnerabilities catalog, meaning CISA has evidence of exploitation in the wild (listed 2025–2025). CISA flags 1 of them as used in ransomware campaigns. The most recent is CVE-2026-102255.
Also listed as: SMA1000 · SMA1000 Appliance Management Console · SMA1000 appliance. CISA, NVD and vendor advisories name the same product differently; each CVE page keeps the wording from its source.
- CVEs tracked
- 5
- On CISA KEV
- 4
- Ransomware use
- 1
- Rated critical
- 2
Every SonicWall SMA1000 Appliances CVE we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV | Patch by |
|---|---|---|---|---|---|
| CVE-2026-102255 Critical remote vulnerability in SonicWall SMA1000write-up | [ CRITICAL ] | 10.0 | 0.5% | — | — |
| CVE-2026-83549 OS Command Injection in SonicWall SMA1000 AMCwrite-up | [ HIGH ] | 7.8 | 9.9% | ||
| CVE-2026-83548 Pre-auth SSRF in SonicWall SMA1000 Workplace Interfacewrite-up | [ HIGH ] | — | 8.0% | ||
| CVE-2025-40602 SonicWall SMA1000 Missing Authorization Vulnerability | [ MEDIUM ] | 6.6 | 2.8% | ||
| CVE-2025-23006 SonicWall SMA1000 Appliances Deserialization Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 23.4% |
Sorted by date added to KEV. Severity and CVSS as stated by NVD or the vendor; EPSS from FIRST.org. "Patch by" is CISA's BOD 22-01 deadline for US federal agencies, a useful priority signal for everyone else. Machine-readable: /api/v1/vendors/sonicwall.json.
Our SonicWall SMA1000 Appliances coverage
Other SonicWall products
Every row links to its CVE record with the CISA required action, catalog coverage and primary sources. We describe impact and remediation only; no exploit code. See the full KEV tracker or compare KEV catalogs.