SM
Product
SMA1000
On CISA KEVExploited in the wildRansomware-linked
14
CVEs
6
On KEV
10.0
Max CVSS
4
New 30D
Severity mix
Critical 4High 7Medium 3Low 0
Watch
Add SMA1000 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-83548 In wildKEV | 10.0 | Sep 1 | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability Affected: 12.4.3-03453 (platform-hotfix) and older versions; 12.5.0-02835 (platform-hotfix) and older versions |
| CVE-2026-15409 RansomwareIn wildKEV | 10.0 | Jul 14 | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability Affected: 12.4.3-03245 through 12.4.3-03434; 12.5.0-02283 through 12.5.0-02800 |
| CVE-2025-23006 RansomwareIn wildKEV | 9.8 | Jan 23 | SonicWall SMA1000 Appliances Deserialization Vulnerability Affected: 12.4.3-02804 (platform-hotfix) and earlier versions. |
| CVE-2026-83549 In wildKEV | 7.8 | Sep 1 | SonicWall SMA1000 Appliances OS Command Injection Vulnerability Affected: 12.4.3-03453 (platform-hotfix) and older versions; 12.5.0-02835 (platform-hotfix) and older versions |
| CVE-2026-15410 RansomwareIn wildKEV | 7.2 | Jul 14 | SonicWall SMA1000 Appliances Code Injection Vulnerability Affected: 12.4.3-03245 through 12.4.3-03434; 12.5.0-02283 through 12.5.0-02800 |
| CVE-2025-40602 In wildKEV | 6.6 | Dec 18 | SonicWall SMA1000 Missing Authorization Vulnerability Affected: 12.4.3-03093 (platform-hotfix) and earlier versions; 12.5.0-02002 (platform-hotfix) and earlier versions |
| CVE-2026-102255 | 10.0 | Oct 7 | A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path Affected: 12.4.3-03526 (platform-hotfix) and older versions; 12.5.0-02952 (platform-hotfix) and older versions |
| CVE-2026-102256 | 7.8 | Oct 7 | Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 appliance which in… Affected: 12.4.3-03526 (platform-hotfix) and older versions; 12.5.0-02952 (platform-hotfix) and older versions |
| CVE-2026-102257 | 7.2 | Oct 7 | A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the intended destination directory using a… Affected: 12.4.3-03526 (platform-hotfix) and older versions; 12.5.0-02952 (platform-hotfix) and older versions |
| CVE-2026-4116 | 7.2 | Apr 9 | Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/Connect Tunnel TOTP authentication Affected: 12.4.3-03245 (platform-hotfix) and earlier versions.; 12.5.0-02283 (platform-hotfix) and earlier versions. |
| CVE-2026-4113 | 7.2 | Apr 9 | An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN user credentials Affected: 12.4.3-03245 (platform-hotfix) and earlier versions.; 12.5.0-02283 (platform-hotfix) and earlier versions. |
| CVE-2026-4112 | 7.2 | Apr 9 | Improper neutralization of special elements used in an SQL command (“SQL Injection”) in SonicWall SMA1000 series appliances allows a remote authenticated attacker with read-only… Affected: 12.4.3-03245 (platform-hotfix) and earlier versions.; 12.5.0-02283 (platform-hotfix) and earlier versions. |
| CVE-2026-4114 | 6.6 | Apr 9 | Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN admin to bypass AMC TOTP authentication Affected: 12.4.3-03245 (platform-hotfix) and earlier versions.; 12.5.0-02283 (platform-hotfix) and earlier versions. |
| CVE-2026-102258 | 6.1 | Oct 7 | Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could… Affected: 12.4.3-03526 (platform-hotfix) and older versions; 12.5.0-02952 (platform-hotfix) and older versions |
Showing 14