The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two (2) actively exploited SonicWall vulnerabilities tracked as CVE-2023-44221, and CVE-2024-38475, to its Known Exploited Vulnerabilities (KEV) catalog after proof-of-concept (PoC) exploit code targeting them was published. These flaws, affecting SonicWall SMA 200, 210, 400, 410, and 500v devices, enable remote attackers to inject OS commands and map URLs to file system locations. Although patches have been available since December 2023 and December 2024, many devices remain unpatched and at risk. CISA has mandated that all Federal Civilian Executive Branch (FCEB) agencies must become compliant and patch these flaws by no later than May 22, 2025. Exploitation likely involves chaining the two (2) vulnerabilities, with CVE-2024-38475 (originally assigned to an Apache HTTP Server vulnerability) allowing authentication bypass and admin control, followed by CVE-2023-44221 enabling command execution as the “nobody” user. Security firm watchTowr Labs has published technical details and released a Detection Artefact Generator, citing the widespread availability of exploitation details. CTIX analysts urge organizations to patch vulnerable SMA 100 series appliances immediately to mitigate the threat and prevent exploitation.