Threat database

CVE-2026-100232 is a high-severity vulnerability in SonicWall Network Security Manager (NSM) on-premises. It is an OS command injection flaw that occurs post-authentication and could allow a remote authenticated attacker to execute arbitrary operating system commands, leading to remote code execution.

CVE-2026-96540 is an improper access control vulnerability in SonicWall Network Security Manager (NSM) on-premises export settings. It allows a remote authenticated attacker with limited privileges to potentially access sensitive information. Exploitation may lead to privilege escalation to administrator level or interception of other users' communications within the NSM instance. The vulnerability has a high severity rating with a CVSS score of 8.8.

Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code in the Appliance Management Console (AMC).

CVE-2026-102257 is a high-severity Zip Slip vulnerability in the SonicWall SMA1000 Appliance Management Console (AMC) interface. It allows an attacker with high privileges to extract files outside the intended directory by using a specially crafted archive, potentially leading to remote code execution.

CVE-2026-102256 is a high-severity vulnerability in the SonicWall SMA1000 appliance involving improper neutralization of special elements in OS commands. This post-authentication flaw could allow a remote authenticated attacker with administrator privileges to execute arbitrary operating system commands, leading to remote code execution. The vulnerability requires authentication and low attack complexity. No specific affected versions or patch information is provided.

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.

A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive.

A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin.

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the underlying host, resulting in remote code execution.

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations.

CVE-2026-66153 is a high-severity vulnerability in the SonicWall NetExtender Linux client. It involves improper handling of temporary files during the NEService auto-upgrade process, allowing an attacker to manipulate file paths due to insecure link resolution before file access. This can lead to unauthorized file access or modification. No patch or official remediation guidance is currently available from the vendor. The vulnerability requires local access with low privileges and has a high attack complexity. There are no known exploits in the wild at this time.

CVE-2026-66152 is a path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component. This flaw allows an attacker to write arbitrary files with root privileges by exploiting improper handling of file paths. The vulnerability has a high severity score of 8.8 and impacts confidentiality, integrity, and availability. No affected versions or patch information are provided in the available data.

Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via SNMP.

Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask.

An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions. A local attacker with the ability to interact with the service could exploit this behavior to perform unauthorized actions through the affected component.

An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions which, under a successful MitM attack and controlled network conditions, could permit unauthorized changes.

An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier versions which allows low-privileged local user to execute system commands with root privileges.