SonicWall SMA1000 Appliances known exploited vulnerabilities, ranked
CISA lists 5 SonicWall SMA1000 Appliances CVEs as exploited in the wild. 4 were added in the last 12 months and 3 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2025-23006: EPSS 23.4%, used in ransomware, added 2025-01-24
- CVE-2026-15410: EPSS 11.8%, used in ransomware, added 2026-07-14
- CVE-2026-83549: EPSS 10.8%, added 2026-09-02
- CVE-2026-83548: EPSS 8.8%, added 2026-09-02
- CVE-2026-15409: EPSS 6.8%, used in ransomware, added 2026-07-14
All 5 SonicWall SMA1000 Appliances CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2025-23006 | SMA1000 Appliances Deserialization | 23.4% | Yes | 2025-01-24 | 2025-02-14 |
| 2 | CVE-2026-15410 | SMA1000 Appliances Code Injection | 11.8% | Yes | 2026-07-14 | 2026-07-17 |
| 3 | CVE-2026-83549 | SMA1000 Appliances OS Command Injection | 10.8% | – | 2026-09-02 | 2026-09-05 |
| 4 | CVE-2026-83548 | SMA1000 Appliances Server-Side Request Forgery | 8.8% | – | 2026-09-02 | 2026-09-05 |
| 5 | CVE-2026-15409 | SMA1000 Appliances Server-Side Request Forgery | 6.8% | Yes | 2026-07-14 | 2026-07-17 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all SonicWall KEV CVEs · free KEV badge for SonicWall · all vendors