CISA Flags SonicWall SMA1000 Flaws as Actively Exploited, Adds Them to KEV List

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced Tuesday that two critical vulnerabilities in SonicWall's SMA1000 series of secure remote access appliances have been placed on its Known Exploited Vulnerabilities (KEV) catalog, indicating that threat actors are already leveraging the weaknesses in live attacks.

The agency’s advisory notes that the flaws—both rated high severity—allow unauthenticated attackers to bypass authentication and potentially execute arbitrary code on affected devices. SonicWall, a provider of network security solutions for enterprises and government agencies, confirmed that the SMA1000 line, used to enable secure VPN connections, is among the products impacted.

CISA’s decision to elevate the vulnerabilities to the KEV catalog signals a heightened risk level, as the list is reserved for flaws that have demonstrable evidence of exploitation in the wild. The agency advises all organizations that deploy the SMA1000 appliances to apply the vendor‑issued patches without delay and to review network traffic for signs of compromise, such as unexpected outbound connections from the devices.

Industry analysts say the move reflects a broader trend of attackers targeting remote‑access infrastructure, especially as hybrid work models increase reliance on VPN and secure‑gateway hardware. The public disclosure of active exploitation also serves to pressure vendors to accelerate remediation efforts and to encourage customers to adopt a more proactive patch‑management posture.

SonicWall has released firmware updates that address the identified weaknesses and recommends that administrators verify the version running on each appliance. In addition, the company urges users to enable multi‑factor authentication and to restrict management access to trusted networks. Organizations that cannot immediately update may consider temporary mitigation steps, such as disabling unnecessary services and monitoring for anomalous login attempts.

Looking ahead, CISA indicated that it will continue to monitor the situation and may issue further guidance if additional exploitation activity is observed. The agency’s KEV catalog, which is part of its broader effort to improve national cyber resilience, will be updated as new threats emerge, underscoring the importance of ongoing vigilance for critical infrastructure operators.