SonicWall security advisories, October 2026

Every SonicWall security advisory published in October 2026, from SonicWall PSIRT ([email protected] CNA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 8
Critical: 1
High: 1
In CISA KEV: 0
CVEs: 6

SonicWall advisories published in October 2026

Oct 14, 2026
High [CVE-2026-100232 +1] Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability ha…
High8.8
Oct 14, 2026
Advisory [CVE-2026-100232] Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem which in specific conditions could potentially enable a remote authenticated attacker to execute arbitrary OS commands, resulting in remote code execution
Unrated
Oct 14, 2026
Advisory [CVE-2026-96540] improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information
Unrated
Oct 7, 2026
Critical [CVE-2026-102255 +3] Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate acc…
Critical10.0
Oct 7, 2026
Advisory [CVE-2026-102258] Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code in the Appliance Management Console (AMC)
Unrated
Oct 7, 2026
Advisory [CVE-2026-102257] Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the intended destination directory using a specially crafted archive, resulting in remote code execution
Unrated
Oct 7, 2026
Advisory [CVE-2026-102256] Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution
Unrated
Oct 7, 2026
Advisory [CVE-2026-102255] Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path
Unrated

Get an email when SonicWall publishes the next one.

See SonicWall's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about SonicWall

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.