Search
Find a vulnerability
Search criteria
727 vulnerabilities by Sonicwall
CVE-2026-102258 (GCVE-0-2026-102258)
Vulnerability from nvd – Published: 2026-10-07 13:16 – Updated: 2026-10-07 14:37
VLAI
EPSS
VEX
Summary
Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code in the Appliance Management Console (AMC).
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 14:37 UTC
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.global.sonicwall.com/vuln-detail/SN… | vendor-advisory |
Impacted products
Date Public
2026-10-07 13:01
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-102258",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T14:37:28.413381Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T14:37:48.768Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "SMA1000",
"vendor": "SonicWall",
"versions": [
{
"status": "affected",
"version": "12.4.3-03526 (platform-hotfix) and older versions"
},
{
"status": "affected",
"version": "12.5.0-02952 (platform-hotfix) and older versions"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Brian Mariani"
}
],
"datePublic": "2026-10-07T13:01:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code in the Appliance Management Console (AMC)."
}
],
"value": "Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code in the Appliance Management Console (AMC)."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T13:16:31.279Z",
"orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"shortName": "sonicwall"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017"
}
],
"source": {
"advisory": "SNWLID-2026-0017",
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"assignerShortName": "sonicwall",
"cveId": "CVE-2026-102258",
"datePublished": "2026-10-07T13:16:31.279Z",
"dateReserved": "2026-09-28T19:39:42.850Z",
"dateUpdated": "2026-10-07T14:37:48.768Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102257 (GCVE-0-2026-102257)
Vulnerability from nvd – Published: 2026-10-07 13:12 – Updated: 2026-10-08 03:55
VLAI
EPSS
VEX
Summary
A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the intended destination directory using a specially crafted archive, resulting in remote code execution.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 00:00 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.global.sonicwall.com/vuln-detail/SN… | vendor-advisory |
Impacted products
Date Public
2026-10-07 13:01
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-102257",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T03:55:24.797Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "SMA1000",
"vendor": "SonicWall",
"versions": [
{
"status": "affected",
"version": "12.4.3-03526 (platform-hotfix) and older versions"
},
{
"status": "affected",
"version": "12.5.0-02952 (platform-hotfix) and older versions"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Brian Mariani"
}
],
"datePublic": "2026-10-07T13:01:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the intended destination directory using a specially crafted archive, resulting in remote code execution."
}
],
"value": "A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the intended destination directory using a specially crafted archive, resulting in remote code execution."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T13:12:25.319Z",
"orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"shortName": "sonicwall"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017"
}
],
"source": {
"advisory": "SNWLID-2026-0017",
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"assignerShortName": "sonicwall",
"cveId": "CVE-2026-102257",
"datePublished": "2026-10-07T13:12:25.319Z",
"dateReserved": "2026-09-28T19:39:42.850Z",
"dateUpdated": "2026-10-08T03:55:24.797Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102256 (GCVE-0-2026-102256)
Vulnerability from nvd – Published: 2026-10-07 13:09 – Updated: 2026-10-08 03:55
VLAI
EPSS
VEX
Summary
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 00:00 UTC
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.global.sonicwall.com/vuln-detail/SN… | vendor-advisory |
Impacted products
Date Public
2026-10-07 13:01
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-102256",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T03:55:25.618Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "SMA1000",
"vendor": "SonicWall",
"versions": [
{
"status": "affected",
"version": "12.4.3-03526 (platform-hotfix) and older versions"
},
{
"status": "affected",
"version": "12.5.0-02952 (platform-hotfix) and older versions"
}
]
}
],
"datePublic": "2026-10-07T13:01:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Post-authentication Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution."
}
],
"value": "Post-authentication Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T13:09:04.342Z",
"orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"shortName": "sonicwall"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017"
}
],
"source": {
"advisory": "SNWLID-2026-0017",
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"assignerShortName": "sonicwall",
"cveId": "CVE-2026-102256",
"datePublished": "2026-10-07T13:09:04.342Z",
"dateReserved": "2026-09-28T19:39:42.850Z",
"dateUpdated": "2026-10-08T03:55:25.618Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102255 (GCVE-0-2026-102255)
Vulnerability from nvd – Published: 2026-10-07 13:07 – Updated: 2026-10-07 15:51
VLAI
EPSS
VEX
Summary
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 15:50 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.global.sonicwall.com/vuln-detail/SN… | vendor-advisory |
Impacted products
Date Public
2026-10-07 13:01
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-102255",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T15:50:57.013778Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T15:51:00.007Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "SMA1000",
"vendor": "SonicWall",
"versions": [
{
"status": "affected",
"version": "12.4.3-03526 (platform-hotfix) and older versions"
},
{
"status": "affected",
"version": "12.5.0-02952 (platform-hotfix) and older versions"
}
]
}
],
"datePublic": "2026-10-07T13:01:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations."
}
],
"value": "A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side request forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-441",
"description": "CWE-441 Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T13:07:13.384Z",
"orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"shortName": "sonicwall"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017"
}
],
"source": {
"advisory": "SNWLID-2026-0017",
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"assignerShortName": "sonicwall",
"cveId": "CVE-2026-102255",
"datePublished": "2026-10-07T13:07:13.384Z",
"dateReserved": "2026-09-28T19:39:42.850Z",
"dateUpdated": "2026-10-07T15:51:00.007Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81939 (GCVE-0-2026-81939)
Vulnerability from nvd – Published: 2026-09-04 18:22 – Updated: 2026-09-04 19:48
VLAI
EPSS
VEX
Summary
A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 19:47 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.global.sonicwall.com/vuln-detail/SN… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SonicWall | Network Security Manager (NSM) |
Affected:
4.3.0 and earlier versions
|
Date Public
2026-09-04 18:10
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-81939",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T19:47:14.778353Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T19:48:35.748Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux",
"On-Prem"
],
"product": "Network Security Manager (NSM)",
"vendor": "SonicWall",
"versions": [
{
"status": "affected",
"version": "4.3.0 and earlier versions"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrei Lungu of Pentest-Tools.com"
}
],
"datePublic": "2026-09-04T18:10:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive."
}
],
"value": "A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T18:22:16.711Z",
"orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"shortName": "sonicwall"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0015"
}
],
"source": {
"advisory": "SNWLID-2026-0015",
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"assignerShortName": "sonicwall",
"cveId": "CVE-2026-81939",
"datePublished": "2026-09-04T18:22:16.711Z",
"dateReserved": "2026-08-27T19:48:11.225Z",
"dateUpdated": "2026-09-04T19:48:35.748Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78328 (GCVE-0-2026-78328)
Vulnerability from nvd – Published: 2026-09-04 18:19 – Updated: 2026-09-04 19:49
VLAI
EPSS
VEX
Summary
A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 19:49 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.global.sonicwall.com/vuln-detail/SN… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SonicWall | Network Security Manager (NSM) |
Affected:
4.3.0 and earlier versions
|
Date Public
2026-09-04 18:10
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-78328",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T19:49:15.329704Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T19:49:34.157Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux",
"On-Prem"
],
"product": "Network Security Manager (NSM)",
"vendor": "SonicWall",
"versions": [
{
"status": "affected",
"version": "4.3.0 and earlier versions"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrei Lungu of Pentest-Tools.com"
}
],
"datePublic": "2026-09-04T18:10:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin."
}
],
"value": "A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T18:19:29.019Z",
"orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"shortName": "sonicwall"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0015"
}
],
"source": {
"advisory": "SNWLID-2026-0015",
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"assignerShortName": "sonicwall",
"cveId": "CVE-2026-78328",
"datePublished": "2026-09-04T18:19:29.019Z",
"dateReserved": "2026-08-24T09:38:46.404Z",
"dateUpdated": "2026-09-04T19:49:34.157Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78327 (GCVE-0-2026-78327)
Vulnerability from nvd – Published: 2026-09-04 18:14 – Updated: 2026-09-04 19:50
VLAI
EPSS
VEX
Summary
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the underlying host, resulting in remote code execution.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 19:49 UTC
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.global.sonicwall.com/vuln-detail/SN… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SonicWall | Network Security Manager (NSM) |
Affected:
4.3.0 and earlier versions
|
Date Public
2026-09-04 18:10
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-78327",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T19:49:49.013441Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T19:50:05.348Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux",
"On-Prem"
],
"product": "Network Security Manager (NSM)",
"vendor": "SonicWall",
"versions": [
{
"status": "affected",
"version": "4.3.0 and earlier versions"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Andrei Lungu and Matei \"Mal\" Badanoiu of Pentest-Tools.com"
}
],
"datePublic": "2026-09-04T18:10:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the underlying host, resulting in remote code execution."
}
],
"value": "An Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the underlying host, resulting in remote code execution."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T18:18:40.616Z",
"orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"shortName": "sonicwall"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0015"
}
],
"source": {
"advisory": "SNWLID-2026-0015",
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"assignerShortName": "sonicwall",
"cveId": "CVE-2026-78327",
"datePublished": "2026-09-04T18:14:54.641Z",
"dateReserved": "2026-08-24T09:38:44.377Z",
"dateUpdated": "2026-09-04T19:50:05.348Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-83549 (GCVE-0-2026-83549)
Vulnerability from nvd – Published: 2026-09-01 21:28 – Updated: 2026-09-21 13:07Summary
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.
Severity
7.8 (High)
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 03:55 UTC
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://psirt.global.sonicwall.com/vuln-detail/SN… | vendor-advisory |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
Date Public
2026-09-01 21:26
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-83549",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T03:55:31.034713Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-09-02",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-83549"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T13:07:29.786Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-83549"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-02T00:00:00.000Z",
"value": "CVE-2026-83549 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "SMA1000",
"vendor": "SonicWall",
"versions": [
{
"status": "affected",
"version": "12.4.3-03453 (platform-hotfix) and older versions"
},
{
"status": "affected",
"version": "12.5.0-02835 (platform-hotfix) and older versions"
}
]
}
],
"datePublic": "2026-09-01T21:26:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Post-authentication Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution."
}
],
"value": "Post-authentication Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T21:28:50.717Z",
"orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"shortName": "sonicwall"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016"
}
],
"source": {
"advisory": "SNWLID-2026-0016",
"discovery": "INTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"assignerShortName": "sonicwall",
"cveId": "CVE-2026-83549",
"datePublished": "2026-09-01T21:28:50.717Z",
"dateReserved": "2026-08-31T18:15:33.840Z",
"dateUpdated": "2026-09-21T13:07:29.786Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-83548 (GCVE-0-2026-83548)
Vulnerability from nvd – Published: 2026-09-01 21:25 – Updated: 2026-09-03 03:55Summary
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations.
Severity
10 (Critical)
SSVC
Exploitation: active
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 00:00 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://psirt.global.sonicwall.com/vuln-detail/SN… | vendor-advisory |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
Date Public
2026-09-01 21:17
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-83548",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-09-02",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-83548"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T03:55:31.337Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-83548"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-02T00:00:00.000Z",
"value": "CVE-2026-83548 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "SMA1000",
"vendor": "SonicWall",
"versions": [
{
"status": "affected",
"version": "12.4.3-03453 (platform-hotfix) and older versions"
},
{
"status": "affected",
"version": "12.5.0-02835 (platform-hotfix) and older versions"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Adam Babis of SonicWall PSIRT"
}
],
"datePublic": "2026-09-01T21:17:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations."
}
],
"value": "A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side request forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-441",
"description": "CWE-441 Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T21:25:45.368Z",
"orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"shortName": "sonicwall"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016"
}
],
"source": {
"advisory": "SNWLID-2026-0016",
"discovery": "INTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"assignerShortName": "sonicwall",
"cveId": "CVE-2026-83548",
"datePublished": "2026-09-01T21:25:45.368Z",
"dateReserved": "2026-08-31T18:15:31.466Z",
"dateUpdated": "2026-09-03T03:55:31.337Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66153 (GCVE-0-2026-66153)
Vulnerability from nvd – Published: 2026-08-25 20:01 – Updated: 2026-08-27 03:55
VLAI
EPSS
VEX
Summary
The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 00:00 UTC
CWE
- CWE-59 - Improper link resolution before file access ('link following')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.global.sonicwall.com/vuln-detail/SN… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SonicWall | NetExtender |
Affected:
10.3.5 and earlier versions
|
Date Public
2026-08-25 19:51
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-66153",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T03:55:46.887Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "NetExtender",
"vendor": "SonicWall",
"versions": [
{
"status": "affected",
"version": "10.3.5 and earlier versions"
}
]
}
],
"datePublic": "2026-08-25T19:51:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths."
}
],
"value": "The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59 Improper link resolution before file access (\u0027link following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T20:01:15.598Z",
"orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"shortName": "sonicwall"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0013"
}
],
"source": {
"advisory": "SNWLID-2026-0013",
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"assignerShortName": "sonicwall",
"cveId": "CVE-2026-66153",
"datePublished": "2026-08-25T20:01:15.598Z",
"dateReserved": "2026-07-24T08:34:11.798Z",
"dateUpdated": "2026-08-27T03:55:46.887Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66152 (GCVE-0-2026-66152)
Vulnerability from nvd – Published: 2026-08-25 19:58 – Updated: 2026-08-31 16:20
VLAI
EPSS
VEX
Summary
A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 00:00 UTC
CWE
- CWE-29 - Path traversal: '\..\filename'
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.global.sonicwall.com/vuln-detail/SN… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SonicWall | NetExtender |
Affected:
10.3.5 and earlier versions
|
Date Public
2026-08-25 19:51
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-66152",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T03:55:45.806Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "NetExtender",
"vendor": "SonicWall",
"versions": [
{
"status": "affected",
"version": "10.3.5 and earlier versions"
}
]
}
],
"datePublic": "2026-08-25T19:51:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root."
}
],
"value": "A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-29",
"description": "CWE-29 Path traversal: \u0027\\..\\filename\u0027",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T16:20:07.120Z",
"orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"shortName": "sonicwall"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0013"
}
],
"source": {
"advisory": "SNWLID-2026-0013",
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"assignerShortName": "sonicwall",
"cveId": "CVE-2026-66152",
"datePublished": "2026-08-25T19:58:47.474Z",
"dateReserved": "2026-07-24T08:34:11.798Z",
"dateUpdated": "2026-08-31T16:20:07.120Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66154 (GCVE-0-2026-66154)
Vulnerability from nvd – Published: 2026-08-11 20:12 – Updated: 2026-08-12 14:47
VLAI
EPSS
VEX
Summary
An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions which, under a successful MitM attack and controlled network conditions, could permit unauthorized changes.
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 04:00 UTC
CWE
- CWE-295 - Improper certificate validation
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.global.sonicwall.com/vuln-detail/SN… | vendor-advisory |
Impacted products
Date Public
2026-08-11 20:00
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-66154",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T04:00:37.248025Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T14:47:58.659Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "GMS",
"vendor": "SonicWall",
"versions": [
{
"status": "affected",
"version": "9.5.1 and earlier versions"
}
]
}
],
"datePublic": "2026-08-11T20:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions which, under a successful MitM attack and controlled network conditions, could permit unauthorized changes."
}
],
"value": "An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions which, under a successful MitM attack and controlled network conditions, could permit unauthorized changes."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper certificate validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T20:12:25.413Z",
"orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"shortName": "sonicwall"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011"
}
],
"source": {
"advisory": "SNWLID-2026-0011",
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"assignerShortName": "sonicwall",
"cveId": "CVE-2026-66154",
"datePublished": "2026-08-11T20:12:25.413Z",
"dateReserved": "2026-07-24T08:34:11.798Z",
"dateUpdated": "2026-08-12T14:47:58.659Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102258 (GCVE-0-2026-102258)
Vulnerability from cvelistv5 – Published: 2026-10-07 13:16 – Updated: 2026-10-07 14:37
VLAI
EPSS
VEX
Summary
Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code in the Appliance Management Console (AMC).
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 14:37 UTC
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.global.sonicwall.com/vuln-detail/SN… | vendor-advisory |
Impacted products
Date Public
2026-10-07 13:01
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-102258",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T14:37:28.413381Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T14:37:48.768Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "SMA1000",
"vendor": "SonicWall",
"versions": [
{
"status": "affected",
"version": "12.4.3-03526 (platform-hotfix) and older versions"
},
{
"status": "affected",
"version": "12.5.0-02952 (platform-hotfix) and older versions"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Brian Mariani"
}
],
"datePublic": "2026-10-07T13:01:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code in the Appliance Management Console (AMC)."
}
],
"value": "Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code in the Appliance Management Console (AMC)."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T13:16:31.279Z",
"orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"shortName": "sonicwall"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017"
}
],
"source": {
"advisory": "SNWLID-2026-0017",
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"assignerShortName": "sonicwall",
"cveId": "CVE-2026-102258",
"datePublished": "2026-10-07T13:16:31.279Z",
"dateReserved": "2026-09-28T19:39:42.850Z",
"dateUpdated": "2026-10-07T14:37:48.768Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102257 (GCVE-0-2026-102257)
Vulnerability from cvelistv5 – Published: 2026-10-07 13:12 – Updated: 2026-10-08 03:55
VLAI
EPSS
VEX
Summary
A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the intended destination directory using a specially crafted archive, resulting in remote code execution.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 00:00 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.global.sonicwall.com/vuln-detail/SN… | vendor-advisory |
Impacted products
Date Public
2026-10-07 13:01
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-102257",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T03:55:24.797Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "SMA1000",
"vendor": "SonicWall",
"versions": [
{
"status": "affected",
"version": "12.4.3-03526 (platform-hotfix) and older versions"
},
{
"status": "affected",
"version": "12.5.0-02952 (platform-hotfix) and older versions"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Brian Mariani"
}
],
"datePublic": "2026-10-07T13:01:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the intended destination directory using a specially crafted archive, resulting in remote code execution."
}
],
"value": "A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the intended destination directory using a specially crafted archive, resulting in remote code execution."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T13:12:25.319Z",
"orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"shortName": "sonicwall"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017"
}
],
"source": {
"advisory": "SNWLID-2026-0017",
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"assignerShortName": "sonicwall",
"cveId": "CVE-2026-102257",
"datePublished": "2026-10-07T13:12:25.319Z",
"dateReserved": "2026-09-28T19:39:42.850Z",
"dateUpdated": "2026-10-08T03:55:24.797Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102256 (GCVE-0-2026-102256)
Vulnerability from cvelistv5 – Published: 2026-10-07 13:09 – Updated: 2026-10-08 03:55
VLAI
EPSS
VEX
Summary
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 00:00 UTC
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.global.sonicwall.com/vuln-detail/SN… | vendor-advisory |
Impacted products
Date Public
2026-10-07 13:01
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-102256",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T03:55:25.618Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "SMA1000",
"vendor": "SonicWall",
"versions": [
{
"status": "affected",
"version": "12.4.3-03526 (platform-hotfix) and older versions"
},
{
"status": "affected",
"version": "12.5.0-02952 (platform-hotfix) and older versions"
}
]
}
],
"datePublic": "2026-10-07T13:01:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Post-authentication Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution."
}
],
"value": "Post-authentication Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T13:09:04.342Z",
"orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"shortName": "sonicwall"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017"
}
],
"source": {
"advisory": "SNWLID-2026-0017",
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"assignerShortName": "sonicwall",
"cveId": "CVE-2026-102256",
"datePublished": "2026-10-07T13:09:04.342Z",
"dateReserved": "2026-09-28T19:39:42.850Z",
"dateUpdated": "2026-10-08T03:55:25.618Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102255 (GCVE-0-2026-102255)
Vulnerability from cvelistv5 – Published: 2026-10-07 13:07 – Updated: 2026-10-07 15:51
VLAI
EPSS
VEX
Summary
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 15:50 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.global.sonicwall.com/vuln-detail/SN… | vendor-advisory |
Impacted products
Date Public
2026-10-07 13:01
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-102255",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T15:50:57.013778Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T15:51:00.007Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "SMA1000",
"vendor": "SonicWall",
"versions": [
{
"status": "affected",
"version": "12.4.3-03526 (platform-hotfix) and older versions"
},
{
"status": "affected",
"version": "12.5.0-02952 (platform-hotfix) and older versions"
}
]
}
],
"datePublic": "2026-10-07T13:01:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations."
}
],
"value": "A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side request forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-441",
"description": "CWE-441 Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T13:07:13.384Z",
"orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"shortName": "sonicwall"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017"
}
],
"source": {
"advisory": "SNWLID-2026-0017",
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"assignerShortName": "sonicwall",
"cveId": "CVE-2026-102255",
"datePublished": "2026-10-07T13:07:13.384Z",
"dateReserved": "2026-09-28T19:39:42.850Z",
"dateUpdated": "2026-10-07T15:51:00.007Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81939 (GCVE-0-2026-81939)
Vulnerability from cvelistv5 – Published: 2026-09-04 18:22 – Updated: 2026-09-04 19:48
VLAI
EPSS
VEX
Summary
A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 19:47 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.global.sonicwall.com/vuln-detail/SN… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SonicWall | Network Security Manager (NSM) |
Affected:
4.3.0 and earlier versions
|
Date Public
2026-09-04 18:10
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-81939",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T19:47:14.778353Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T19:48:35.748Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux",
"On-Prem"
],
"product": "Network Security Manager (NSM)",
"vendor": "SonicWall",
"versions": [
{
"status": "affected",
"version": "4.3.0 and earlier versions"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrei Lungu of Pentest-Tools.com"
}
],
"datePublic": "2026-09-04T18:10:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive."
}
],
"value": "A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T18:22:16.711Z",
"orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"shortName": "sonicwall"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0015"
}
],
"source": {
"advisory": "SNWLID-2026-0015",
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"assignerShortName": "sonicwall",
"cveId": "CVE-2026-81939",
"datePublished": "2026-09-04T18:22:16.711Z",
"dateReserved": "2026-08-27T19:48:11.225Z",
"dateUpdated": "2026-09-04T19:48:35.748Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78328 (GCVE-0-2026-78328)
Vulnerability from cvelistv5 – Published: 2026-09-04 18:19 – Updated: 2026-09-04 19:49
VLAI
EPSS
VEX
Summary
A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 19:49 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.global.sonicwall.com/vuln-detail/SN… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SonicWall | Network Security Manager (NSM) |
Affected:
4.3.0 and earlier versions
|
Date Public
2026-09-04 18:10
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-78328",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T19:49:15.329704Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T19:49:34.157Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux",
"On-Prem"
],
"product": "Network Security Manager (NSM)",
"vendor": "SonicWall",
"versions": [
{
"status": "affected",
"version": "4.3.0 and earlier versions"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrei Lungu of Pentest-Tools.com"
}
],
"datePublic": "2026-09-04T18:10:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin."
}
],
"value": "A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T18:19:29.019Z",
"orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"shortName": "sonicwall"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0015"
}
],
"source": {
"advisory": "SNWLID-2026-0015",
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"assignerShortName": "sonicwall",
"cveId": "CVE-2026-78328",
"datePublished": "2026-09-04T18:19:29.019Z",
"dateReserved": "2026-08-24T09:38:46.404Z",
"dateUpdated": "2026-09-04T19:49:34.157Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78327 (GCVE-0-2026-78327)
Vulnerability from cvelistv5 – Published: 2026-09-04 18:14 – Updated: 2026-09-04 19:50
VLAI
EPSS
VEX
Summary
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the underlying host, resulting in remote code execution.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 19:49 UTC
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.global.sonicwall.com/vuln-detail/SN… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SonicWall | Network Security Manager (NSM) |
Affected:
4.3.0 and earlier versions
|
Date Public
2026-09-04 18:10
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-78327",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T19:49:49.013441Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T19:50:05.348Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux",
"On-Prem"
],
"product": "Network Security Manager (NSM)",
"vendor": "SonicWall",
"versions": [
{
"status": "affected",
"version": "4.3.0 and earlier versions"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Andrei Lungu and Matei \"Mal\" Badanoiu of Pentest-Tools.com"
}
],
"datePublic": "2026-09-04T18:10:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the underlying host, resulting in remote code execution."
}
],
"value": "An Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the underlying host, resulting in remote code execution."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T18:18:40.616Z",
"orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"shortName": "sonicwall"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0015"
}
],
"source": {
"advisory": "SNWLID-2026-0015",
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"assignerShortName": "sonicwall",
"cveId": "CVE-2026-78327",
"datePublished": "2026-09-04T18:14:54.641Z",
"dateReserved": "2026-08-24T09:38:44.377Z",
"dateUpdated": "2026-09-04T19:50:05.348Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-83549 (GCVE-0-2026-83549)
Vulnerability from cvelistv5 – Published: 2026-09-01 21:28 – Updated: 2026-09-21 13:07Summary
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.
Severity
7.8 (High)
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 03:55 UTC
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://psirt.global.sonicwall.com/vuln-detail/SN… | vendor-advisory |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
Date Public
2026-09-01 21:26
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-83549",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T03:55:31.034713Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-09-02",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-83549"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T13:07:29.786Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-83549"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-02T00:00:00.000Z",
"value": "CVE-2026-83549 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "SMA1000",
"vendor": "SonicWall",
"versions": [
{
"status": "affected",
"version": "12.4.3-03453 (platform-hotfix) and older versions"
},
{
"status": "affected",
"version": "12.5.0-02835 (platform-hotfix) and older versions"
}
]
}
],
"datePublic": "2026-09-01T21:26:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Post-authentication Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution."
}
],
"value": "Post-authentication Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T21:28:50.717Z",
"orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"shortName": "sonicwall"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016"
}
],
"source": {
"advisory": "SNWLID-2026-0016",
"discovery": "INTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"assignerShortName": "sonicwall",
"cveId": "CVE-2026-83549",
"datePublished": "2026-09-01T21:28:50.717Z",
"dateReserved": "2026-08-31T18:15:33.840Z",
"dateUpdated": "2026-09-21T13:07:29.786Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-83548 (GCVE-0-2026-83548)
Vulnerability from cvelistv5 – Published: 2026-09-01 21:25 – Updated: 2026-09-03 03:55Summary
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations.
Severity
10 (Critical)
SSVC
Exploitation: active
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 00:00 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://psirt.global.sonicwall.com/vuln-detail/SN… | vendor-advisory |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
Date Public
2026-09-01 21:17
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-83548",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-09-02",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-83548"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T03:55:31.337Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-83548"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-02T00:00:00.000Z",
"value": "CVE-2026-83548 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "SMA1000",
"vendor": "SonicWall",
"versions": [
{
"status": "affected",
"version": "12.4.3-03453 (platform-hotfix) and older versions"
},
{
"status": "affected",
"version": "12.5.0-02835 (platform-hotfix) and older versions"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Adam Babis of SonicWall PSIRT"
}
],
"datePublic": "2026-09-01T21:17:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations."
}
],
"value": "A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side request forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-441",
"description": "CWE-441 Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T21:25:45.368Z",
"orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"shortName": "sonicwall"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016"
}
],
"source": {
"advisory": "SNWLID-2026-0016",
"discovery": "INTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"assignerShortName": "sonicwall",
"cveId": "CVE-2026-83548",
"datePublished": "2026-09-01T21:25:45.368Z",
"dateReserved": "2026-08-31T18:15:31.466Z",
"dateUpdated": "2026-09-03T03:55:31.337Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66153 (GCVE-0-2026-66153)
Vulnerability from cvelistv5 – Published: 2026-08-25 20:01 – Updated: 2026-08-27 03:55
VLAI
EPSS
VEX
Summary
The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 00:00 UTC
CWE
- CWE-59 - Improper link resolution before file access ('link following')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.global.sonicwall.com/vuln-detail/SN… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SonicWall | NetExtender |
Affected:
10.3.5 and earlier versions
|
Date Public
2026-08-25 19:51
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-66153",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T03:55:46.887Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "NetExtender",
"vendor": "SonicWall",
"versions": [
{
"status": "affected",
"version": "10.3.5 and earlier versions"
}
]
}
],
"datePublic": "2026-08-25T19:51:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths."
}
],
"value": "The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59 Improper link resolution before file access (\u0027link following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T20:01:15.598Z",
"orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"shortName": "sonicwall"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0013"
}
],
"source": {
"advisory": "SNWLID-2026-0013",
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"assignerShortName": "sonicwall",
"cveId": "CVE-2026-66153",
"datePublished": "2026-08-25T20:01:15.598Z",
"dateReserved": "2026-07-24T08:34:11.798Z",
"dateUpdated": "2026-08-27T03:55:46.887Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66152 (GCVE-0-2026-66152)
Vulnerability from cvelistv5 – Published: 2026-08-25 19:58 – Updated: 2026-08-31 16:20
VLAI
EPSS
VEX
Summary
A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 00:00 UTC
CWE
- CWE-29 - Path traversal: '\..\filename'
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.global.sonicwall.com/vuln-detail/SN… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SonicWall | NetExtender |
Affected:
10.3.5 and earlier versions
|
Date Public
2026-08-25 19:51
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-66152",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T03:55:45.806Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "NetExtender",
"vendor": "SonicWall",
"versions": [
{
"status": "affected",
"version": "10.3.5 and earlier versions"
}
]
}
],
"datePublic": "2026-08-25T19:51:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root."
}
],
"value": "A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-29",
"description": "CWE-29 Path traversal: \u0027\\..\\filename\u0027",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T16:20:07.120Z",
"orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"shortName": "sonicwall"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0013"
}
],
"source": {
"advisory": "SNWLID-2026-0013",
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"assignerShortName": "sonicwall",
"cveId": "CVE-2026-66152",
"datePublished": "2026-08-25T19:58:47.474Z",
"dateReserved": "2026-07-24T08:34:11.798Z",
"dateUpdated": "2026-08-31T16:20:07.120Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CERTFR-2026-AVI-1275
Vulnerability from certfr_avis - Published: 2026-10-07 - Updated: 2026-10-07
De multiples vulnérabilités ont été découvertes dans Sonicwall Secure Mobile Access. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une falsification de requêtes côté serveur (SSRF) et une injection de code indirecte à distance (XSS).
L'éditeur ne fait pas mention d'exploitations actives pour le moment.
Cependant, le CERT-FR rappelle que des combinaisons de deux vulnérabilités, l'une permettant à un attaquant authentifié d'exécuter du code arbitraire à distance, facilitée par l'autre (de type SSRF) permettant de contourner cette authentification, ont déjà été activement exploitées à plusieurs reprises cette année sur ce produit (cf. section Documentation).
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Sonicwall | Secure Mobile Access | SMA1000 versions antérieures à 12.4.3-03670 | ||
| Sonicwall | Secure Mobile Access | SMA1000 versions 12.5 antérieures à 12.5.0-03082 |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SMA1000 versions ant\u00e9rieures \u00e0 12.4.3-03670",
"product": {
"name": "Secure Mobile Access",
"vendor": {
"name": "Sonicwall",
"scada": false
}
}
},
{
"description": "SMA1000 versions 12.5 ant\u00e9rieures \u00e0 12.5.0-03082",
"product": {
"name": "Secure Mobile Access",
"vendor": {
"name": "Sonicwall",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-102256",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-102256"
},
{
"name": "CVE-2026-102255",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-102255"
},
{
"name": "CVE-2026-102258",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-102258"
},
{
"name": "CVE-2026-102257",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-102257"
}
],
"initial_release_date": "2026-10-07T00:00:00",
"last_revision_date": "2026-10-07T00:00:00",
"links": [
{
"title": "Alerte CERT-FR CERTFR-2026-ALE-006 du 15 juillet 2026",
"url": "/alerte/CERTFR-2026-ALE-006/"
},
{
"title": "Alerte CERT-FR CERTFR-2026-ALE-009 du 02 septembre 2026",
"url": "/alerte/CERTFR-2026-ALE-009/"
}
],
"reference": "CERTFR-2026-AVI-1275",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-10-07T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Sonicwall Secure Mobile Access. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF) et une injection de code indirecte \u00e0 distance (XSS).\n\nL\u0027\u00e9diteur ne fait pas mention d\u0027exploitations actives pour le moment.\u003cbr\u003e\nCependant, le CERT-FR rappelle que des combinaisons de deux vuln\u00e9rabilit\u00e9s, l\u0027une permettant \u00e0 un attaquant authentifi\u00e9 d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance, facilit\u00e9e par l\u0027autre (de type SSRF) permettant de contourner cette authentification, ont d\u00e9j\u00e0 \u00e9t\u00e9 activement exploit\u00e9es \u00e0 plusieurs reprises cette ann\u00e9e sur ce produit (cf. section Documentation).",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Sonicwall Secure Mobile Access",
"vendor_advisories": [
{
"published_at": "2026-10-06",
"title": "Bulletin de s\u00e9curit\u00e9 SonicWall SNWLID-2026-0017",
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017"
}
]
}
CERTFR-2026-AVI-1115
Vulnerability from certfr_avis - Published: 2026-09-04 - Updated: 2026-09-04
De multiples vulnérabilités ont été découvertes dans Sonicwall Network Security Manager. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Sonicwall | Network Security Manager | Network Security Manager On-Prem (VMWare, Hyper-V, Azure et KVM) versions antérieures à 4.3.1-R4 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Network Security Manager On-Prem (VMWare, Hyper-V, Azure et KVM) versions ant\u00e9rieures \u00e0 4.3.1-R4",
"product": {
"name": "Network Security Manager",
"vendor": {
"name": "Sonicwall",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-81939",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-81939"
},
{
"name": "CVE-2026-78328",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-78328"
},
{
"name": "CVE-2026-78327",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-78327"
}
],
"initial_release_date": "2026-09-04T00:00:00",
"last_revision_date": "2026-09-04T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1115",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-09-04T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Sonicwall Network Security Manager. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Sonicwall Network Security Manager",
"vendor_advisories": [
{
"published_at": "2026-09-03",
"title": "Bulletin de s\u00e9curit\u00e9 SonicWall SNWLID-2026-0015",
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0015"
}
]
}
CERTFR-2026-AVI-1103
Vulnerability from certfr_avis - Published: 2026-09-02 - Updated: 2026-09-02
De multiples vulnérabilités ont été découvertes dans les produits SonicWall. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et une falsification de requêtes côté serveur (SSRF).
L'éditeur indique que les vulnérabilités CVE-2026-83548 et CVE-2026-83549 sont activement exploités.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Sonicwall | Secure Mobile Access | Modèles SMA1000 6210, 7210 et 8200v versions antérieures à 12.4.3-03526 | ||
| Sonicwall | Secure Mobile Access | Modèles SMA1000 6210, 7210 et 8200v versions 12.5.x antérieures à 12.5.0-02952 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Mod\u00e8les SMA1000 6210, 7210 et 8200v versions ant\u00e9rieures \u00e0 12.4.3-03526",
"product": {
"name": "Secure Mobile Access",
"vendor": {
"name": "Sonicwall",
"scada": false
}
}
},
{
"description": "Mod\u00e8les SMA1000 6210, 7210 et 8200v versions 12.5.x ant\u00e9rieures \u00e0 12.5.0-02952",
"product": {
"name": "Secure Mobile Access",
"vendor": {
"name": "Sonicwall",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-83549",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-83549"
},
{
"name": "CVE-2026-83548",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-83548"
}
],
"initial_release_date": "2026-09-02T00:00:00",
"last_revision_date": "2026-09-02T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1103",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-09-02T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SonicWall. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance et une falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF).\n\nL\u0027\u00e9diteur indique que les vuln\u00e9rabilit\u00e9s CVE-2026-83548 et CVE-2026-83549 sont activement exploit\u00e9s.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SonicWall",
"vendor_advisories": [
{
"published_at": "2026-09-01",
"title": "Bulletin de s\u00e9curit\u00e9 SonicWall SNWLID-2026-0016",
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016"
}
]
}
CERTFR-2026-AVI-1084
Vulnerability from certfr_avis - Published: 2026-08-26 - Updated: 2026-08-26
De multiples vulnérabilités ont été découvertes dans SonicWall NetExtender. Elles permettent à un attaquant de provoquer un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Sonicwall | NetExtender | NetExtender Linux Client versions antérieures à 10.3.6 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "NetExtender Linux Client versions ant\u00e9rieures \u00e0 10.3.6",
"product": {
"name": "NetExtender",
"vendor": {
"name": "Sonicwall",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-66152",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66152"
},
{
"name": "CVE-2026-66153",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66153"
}
],
"initial_release_date": "2026-08-26T00:00:00",
"last_revision_date": "2026-08-26T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1084",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-08-26T00:00:00.000000"
}
],
"risks": [
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans SonicWall NetExtender. Elles permettent \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans SonicWall NetExtender",
"vendor_advisories": [
{
"published_at": "2026-08-25",
"title": "Bulletin de s\u00e9curit\u00e9 SonicWall SNWLID-2026-0013",
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0013"
}
]
}
CERTFR-2026-AVI-1006
Vulnerability from certfr_avis - Published: 2026-08-12 - Updated: 2026-08-12
De multiples vulnérabilités ont été découvertes dans les produits SonicWall. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Sonicwall | Email Security | Email Security versions antérieures à 10.0.36 | ||
| Sonicwall | N/A | GMS versions antérieures à 9.5.2 |
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Email Security versions ant\u00e9rieures \u00e0 10.0.36",
"product": {
"name": "Email Security",
"vendor": {
"name": "Sonicwall",
"scada": false
}
}
},
{
"description": "GMS versions ant\u00e9rieures \u00e0 9.5.2 ",
"product": {
"name": "N/A",
"vendor": {
"name": "Sonicwall",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-66150",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66150"
},
{
"name": "CVE-2026-66154",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66154"
},
{
"name": "CVE-2026-66148",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66148"
},
{
"name": "CVE-2026-66149",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66149"
},
{
"name": "CVE-2026-66147",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66147"
},
{
"name": "CVE-2026-66146",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66146"
},
{
"name": "CVE-2026-18634",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18634"
},
{
"name": "CVE-2026-66145",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66145"
}
],
"initial_release_date": "2026-08-12T00:00:00",
"last_revision_date": "2026-08-12T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1006",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-08-12T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SonicWall. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SonicWall",
"vendor_advisories": [
{
"published_at": "2026-08-11",
"title": "Bulletin de s\u00e9curit\u00e9 SonicWall SNWLID-2026-0012",
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0012"
},
{
"published_at": "2026-08-11",
"title": "Bulletin de s\u00e9curit\u00e9 SonicWall SNWLID-2026-0011",
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011"
}
]
}
GCVE-1988-2026-0037
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-09 10:11
VLAI
EPSS
VEX
Title
[0day-Rubbish] SonicWall SMA 1000 — Pre-Auth Deserialization RCE (CVSS 9.8) via Struts 1 Property Injection and Auth-Filter Rewrite
Summary
Full-Disclosure List,
An unauthenticated remote code execution vulnerability chain in SonicWall SMA 1000 series appliances is being disclosed
here. The chain yields code execution as the `mgmt-server` user (uid=1011) on the management plane, with no credentials
and no prior knowledge of the appliance beyond a reachable address.
A full technical writeup with a reproducible proof-of-concept is published at:
https://0day-rubbish.com/blog/sonicwall-sma-preauth-deserialization-rce
Repository (advisory + PoC):
https://github.com/Exploit-Garbage/0day-Rubbish
-----------------------------------------------------------------
1. Summary
-----------------------------------------------------------------
A four-stage pre-auth chain combines a Struts 1 property-injection
flaw, an in-memory Jetty authentication-filter rewrite, an unauthenticated
SSO Primary-Administrator token issuance, and a Java deserialization sink.
The result is unauthenticated RCE as `mgmt-server` (uid=1011).
CVSS 3.1 base: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Vector: network, low complexity, no privileges, no user interaction.
-----------------------------------------------------------------
2. Affected product
-----------------------------------------------------------------
Vendor: SonicWall
Product: SMA 1000 series (Secure Mobile Access)
Firmware: 12.4.x line (verified on a 12.4 build; other 12.x lines
may share the Struts 1 / Jetty console stack — not all
were independently tested).
Component: /Console management plane, Central Management Service (CMS),
/configUserCommunityEPC.do
-----------------------------------------------------------------
3. Vulnerability details
-----------------------------------------------------------------
Stage 1 — Authentication bypass via Struts 1 property injection
Every Struts 1 ActionForm exposes a `multipartRequestHandler`
property. By walking the bean graph
(`servletContext -> servletHandler -> filterMappings`) an
unauthenticated caller can rewrite the Jetty authentication
filter's pathSpecs to a non-existent path and force the filter
cache to rebuild. The entire `/Console` API and console actions
become reachable without authentication.
Stage 2 — Enable Central Management Service
With `/Console` unauthenticated, Central Management Service (CMS)
can be enabled from the console API, preparing the SSO token path.
Stage 3 — Unauthenticated SSO Primary Admin token
GET /Console/CentralManagement/SSO/Authorize?user=admin&roleUser=Primary+Admin
returns a Primary Administrator token without any password. The
token is exchanged for a valid JSESSIONID. The attacker is now the
Primary Administrator, fully unauthenticated.
Stage 4 — Java deserialization RCE
The `storedCommunity` field of `/configUserCommunityEPC.do` is
consumed by a setter that calls `ObjectInputStream.readObject()`
on attacker-controlled input. A `BeanComparator` + `TemplatesImpl`
gadget chain is delivered through this field. The command executes
as `mgmt-server` (uid=1011). Output is written to the webroot and
read back via an anonymous GET.
-----------------------------------------------------------------
4. Impact
-----------------------------------------------------------------
- Unauthenticated remote code execution as `mgmt-server`.
- Full compromise of the SMA 1000 management plane.
- The appliance terminates remote-access VPN sessions; compromise
of the management plane can be leveraged to pivot into the
protected internal network and to intercept or reset VPN sessions.
- No credentials, no user interaction, no prior appliance knowledge
beyond a reachable HTTPS address.
-----------------------------------------------------------------
5. Proof of concept
-----------------------------------------------------------------
A reproducible PoC is included in the repository under
`product/sonicwall/sma-12.4/preauth-deserialization-rce/exploit`.
The full chain and reproduction steps are documented in the advisory
URL above. The PoC contains no operator-identifying information and
targets placeholder hosts.
-----------------------------------------------------------------
6. Disclosure timeline
-----------------------------------------------------------------
- 2026-07-26: Technical writeup + PoC published to the project
site and repository.
- 2026-07-27: This Full-Disclosure submission.
Vendor contact: SonicWall PSIRT was notified (cc'd). A coordinated
embargo was not requested by the operator prior to publication; this
submission is made in parallel with public availability of the
writeup.
-----------------------------------------------------------------
7. Credits
-----------------------------------------------------------------
Discovered and documented by the 0day-Rubbish independent
vulnerability-research project.
-----------------------------------------------------------------
8. References
-----------------------------------------------------------------
- Advisory: https://0day-rubbish.com/blog/sonicwall-sma-preauth-deserialization-rce
- Repo: https://github.com/Exploit-Garbage/0day-Rubbish
--
0day-Rubbish
disclosure () 0day-rubbish com
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Sonicwall | SonicWall SMA 1000 |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "SonicWall SMA 1000",
"vendor": "Sonicwall",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "disclosure via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "Full-Disclosure List,\n\nAn unauthenticated remote code execution vulnerability chain in SonicWall SMA 1000 series appliances is being disclosed \nhere. The chain yields code execution as the `mgmt-server` user (uid=1011) on the management plane, with no credentials \nand no prior knowledge of the appliance beyond a reachable address.\n\nA full technical writeup with a reproducible proof-of-concept is published at:\n\n https://0day-rubbish.com/blog/sonicwall-sma-preauth-deserialization-rce\n\nRepository (advisory + PoC):\n\n https://github.com/Exploit-Garbage/0day-Rubbish\n\n-----------------------------------------------------------------\n1. Summary\n-----------------------------------------------------------------\n\nA four-stage pre-auth chain combines a Struts 1 property-injection\nflaw, an in-memory Jetty authentication-filter rewrite, an unauthenticated\nSSO Primary-Administrator token issuance, and a Java deserialization sink.\nThe result is unauthenticated RCE as `mgmt-server` (uid=1011).\n\nCVSS 3.1 base: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\nVector: network, low complexity, no privileges, no user interaction.\n\n-----------------------------------------------------------------\n2. Affected product\n-----------------------------------------------------------------\n\nVendor: SonicWall\nProduct: SMA 1000 series (Secure Mobile Access)\nFirmware: 12.4.x line (verified on a 12.4 build; other 12.x lines\n may share the Struts 1 / Jetty console stack \u2014 not all\n were independently tested).\nComponent: /Console management plane, Central Management Service (CMS),\n /configUserCommunityEPC.do\n\n-----------------------------------------------------------------\n3. Vulnerability details\n-----------------------------------------------------------------\n\nStage 1 \u2014 Authentication bypass via Struts 1 property injection\n Every Struts 1 ActionForm exposes a `multipartRequestHandler`\n property. By walking the bean graph\n (`servletContext -\u003e servletHandler -\u003e filterMappings`) an\n unauthenticated caller can rewrite the Jetty authentication\n filter\u0027s pathSpecs to a non-existent path and force the filter\n cache to rebuild. The entire `/Console` API and console actions\n become reachable without authentication.\n\nStage 2 \u2014 Enable Central Management Service\n With `/Console` unauthenticated, Central Management Service (CMS)\n can be enabled from the console API, preparing the SSO token path.\n\nStage 3 \u2014 Unauthenticated SSO Primary Admin token\n GET /Console/CentralManagement/SSO/Authorize?user=admin\u0026roleUser=Primary+Admin\n returns a Primary Administrator token without any password. The\n token is exchanged for a valid JSESSIONID. The attacker is now the\n Primary Administrator, fully unauthenticated.\n\nStage 4 \u2014 Java deserialization RCE\n The `storedCommunity` field of `/configUserCommunityEPC.do` is\n consumed by a setter that calls `ObjectInputStream.readObject()`\n on attacker-controlled input. A `BeanComparator` + `TemplatesImpl`\n gadget chain is delivered through this field. The command executes\n as `mgmt-server` (uid=1011). Output is written to the webroot and\n read back via an anonymous GET.\n\n-----------------------------------------------------------------\n4. Impact\n-----------------------------------------------------------------\n\n- Unauthenticated remote code execution as `mgmt-server`.\n- Full compromise of the SMA 1000 management plane.\n- The appliance terminates remote-access VPN sessions; compromise\n of the management plane can be leveraged to pivot into the\n protected internal network and to intercept or reset VPN sessions.\n- No credentials, no user interaction, no prior appliance knowledge\n beyond a reachable HTTPS address.\n\n-----------------------------------------------------------------\n5. Proof of concept\n-----------------------------------------------------------------\n\nA reproducible PoC is included in the repository under\n`product/sonicwall/sma-12.4/preauth-deserialization-rce/exploit`.\nThe full chain and reproduction steps are documented in the advisory\nURL above. The PoC contains no operator-identifying information and\ntargets placeholder hosts.\n\n-----------------------------------------------------------------\n6. Disclosure timeline\n-----------------------------------------------------------------\n\n- 2026-07-26: Technical writeup + PoC published to the project\n site and repository.\n- 2026-07-27: This Full-Disclosure submission.\n\nVendor contact: SonicWall PSIRT was notified (cc\u0027d). A coordinated\nembargo was not requested by the operator prior to publication; this\nsubmission is made in parallel with public availability of the\nwriteup.\n\n-----------------------------------------------------------------\n7. Credits\n-----------------------------------------------------------------\n\nDiscovered and documented by the 0day-Rubbish independent\nvulnerability-research project.\n\n-----------------------------------------------------------------\n8. References\n-----------------------------------------------------------------\n\n- Advisory: https://0day-rubbish.com/blog/sonicwall-sma-preauth-deserialization-rce\n- Repo: https://github.com/Exploit-Garbage/0day-Rubbish\n\n--\n0day-Rubbish\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T10:11:28Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/2"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/2"
},
{
"url": "https://0day-rubbish.com"
},
{
"url": "https://0day-rubbish.com/blog/sonicwall-sma-preauth-deserialization-rce"
},
{
"url": "https://github.com/Exploit-Garbage/0day-Rubbish"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/2"
],
"discovery": "EXTERNAL"
},
"title": "[0day-Rubbish] SonicWall SMA 1000 \u2014 Pre-Auth Deserialization RCE (CVSS 9.8) via Struts 1 Property Injection and Auth-Filter Rewrite",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0037",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/2",
"automated": true,
"contentSha256": "78588e06d62af725c03928b8b4da89488c10191a6628c7abfa57534c7dde9d20",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/2",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-07-27T03:58:55Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:21Z",
"dateUpdated": "2026-09-09T10:11:28Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0037"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CERTFR-2026-ALE-009
Vulnerability from certfr_alerte - Published: 2026-09-02 - Updated: 2026-09-02
Le 01 septembre 2026, SonicWall a publié un avis de sécurité concernant deux vulnérabilités affectant les Secure Mobile Access (SMA) 1000.
La vulnérabilité critique CVE-2026-83548 permet une falsification de requêtes côté serveur (SSRF) de la part d'un attaquant non authentifié.
La vulnérabilité CVE-2026-83549 permet à un attaquant authentifié avec les droits administrateur d'exécuter du code arbitraire à distance.
L'éditeur indique que ces deux vulnérabilités sont activement exploitées, sans préciser s'il est possible pour un attaquant non authentifié de chaîner l'exploitation de ces deux vulnérabilités pour prendre la main sur l'équipement.
L'obtention des marqueurs de compromission se fait en contactant le support technique de SonicWall.
L'application des correctifs n'est pas suffisante. En effet, l'éditeur recommande de :
- réinstaller le système ;
- changer tous les mots de passe utilisateurs et administrateurs ;
- réinitialiser les mots de passe à usage unique basé sur le temps (TOTP, Time based One Time Password).
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Sonicwall | Secure Mobile Access | Modèles SMA1000 6210, 7210 et 8200v versions antérieures à 12.4.3-03526 | ||
| Sonicwall | Secure Mobile Access | Modèles SMA1000 6210, 7210 et 8200v versions 12.5.x antérieures à 12.5.0-02952 |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Mod\u00e8les SMA1000 6210, 7210 et 8200v versions ant\u00e9rieures \u00e0 12.4.3-03526",
"product": {
"name": "Secure Mobile Access",
"vendor": {
"name": "Sonicwall",
"scada": false
}
}
},
{
"description": "Mod\u00e8les SMA1000 6210, 7210 et 8200v versions 12.5.x ant\u00e9rieures \u00e0 12.5.0-02952",
"product": {
"name": "Secure Mobile Access",
"vendor": {
"name": "Sonicwall",
"scada": false
}
}
}
],
"affected_systems_content": "",
"closed_at": null,
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-83549",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-83549"
},
{
"name": "CVE-2026-83548",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-83548"
}
],
"initial_release_date": "2026-09-02T00:00:00",
"last_revision_date": "2026-09-02T00:00:00",
"links": [
{
"title": "Communication SonicWall du 01 septembre 2026",
"url": "https://www.sonicwall.com/support/notices/product-notice-sma-1000-series-affected-by-multiple-vulnerabilities-snwlid-2026-0016/kA1VN000002AXmQ0AW"
},
{
"title": "Avis CERT-FR CERTFR-2026-AVI-1103 du 01 septembre 2026",
"url": " https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1103/ "
}
],
"reference": "CERTFR-2026-ALE-009",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-09-02T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
}
],
"summary": "Le 01 septembre 2026, SonicWall a publi\u00e9 un avis de s\u00e9curit\u00e9 concernant deux vuln\u00e9rabilit\u00e9s affectant les Secure Mobile Access (SMA) 1000.\n\nLa vuln\u00e9rabilit\u00e9 critique CVE-2026-83548 permet une falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF) de la part d\u0027un attaquant non authentifi\u00e9.\n\nLa vuln\u00e9rabilit\u00e9 CVE-2026-83549 permet \u00e0 un attaquant authentifi\u00e9 avec les droits administrateur d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance.\n\nL\u0027\u00e9diteur indique que ces deux vuln\u00e9rabilit\u00e9s sont activement exploit\u00e9es, sans pr\u00e9ciser s\u0027il est possible pour un attaquant non authentifi\u00e9 de cha\u00eener l\u0027exploitation de ces deux vuln\u00e9rabilit\u00e9s pour prendre la main sur l\u0027\u00e9quipement.\n\nL\u0027obtention des marqueurs de compromission se fait en contactant le support technique de SonicWall.\n\nL\u0027application des correctifs n\u0027est pas suffisante. En effet, l\u0027\u00e9diteur recommande de :\n\u003cul\u003e\n\u003cli\u003er\u00e9installer le syst\u00e8me ; \u003c/li\u003e\n\u003cli\u003echanger tous les mots de passe utilisateurs et administrateurs ; \u003c/li\u003e\n\u003cli\u003er\u00e9initialiser les mots de passe \u00e0 usage unique bas\u00e9 sur le temps (\u003ci\u003eTOTP\u003c/i\u003e, \u003ci\u003eTime based One Time Password\u003c/i\u003e).\u003c/li\u003e\n\u003c/ul\u003e\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans SonicWall Secure Mobile Access",
"vendor_advisories": [
{
"published_at": "2026-09-01",
"title": "Bulletin de s\u00e9curit\u00e9 SonicWall SNWLID-2026-0016",
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016"
}
]
}