Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-81939 (GCVE-0-2026-81939)

Vulnerability from nvd – Published: 2026-09-04 18:22 – Updated: 2026-09-04 19:48

Summary

A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-04 19:47 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

sonicwall mitre root

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	Network Security Manager (NSM)	Affected: 4.3.0 and earlier versions

Date Public

2026-09-04 18:10

Credits

Andrei Lungu of Pentest-Tools.com

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-81939",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T19:47:14.778353Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T19:48:35.748Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux",
            "On-Prem"
          ],
          "product": "Network Security Manager (NSM)",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "4.3.0 and earlier versions"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Andrei Lungu of Pentest-Tools.com"
        }
      ],
      "datePublic": "2026-09-04T18:10:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive."
            }
          ],
          "value": "A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T18:22:16.711Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0015"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0015",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-81939",
    "datePublished": "2026-09-04T18:22:16.711Z",
    "dateReserved": "2026-08-27T19:48:11.225Z",
    "dateUpdated": "2026-09-04T19:48:35.748Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-78328 (GCVE-0-2026-78328)

Vulnerability from nvd – Published: 2026-09-04 18:19 – Updated: 2026-09-04 19:49

Summary

A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-04 19:49 UTC

CWE

CWE-862 - Missing Authorization

Assigner

sonicwall mitre root

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	Network Security Manager (NSM)	Affected: 4.3.0 and earlier versions

Date Public

2026-09-04 18:10

Credits

Andrei Lungu of Pentest-Tools.com

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-78328",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T19:49:15.329704Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T19:49:34.157Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux",
            "On-Prem"
          ],
          "product": "Network Security Manager (NSM)",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "4.3.0 and earlier versions"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Andrei Lungu of Pentest-Tools.com"
        }
      ],
      "datePublic": "2026-09-04T18:10:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin."
            }
          ],
          "value": "A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T18:19:29.019Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0015"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0015",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-78328",
    "datePublished": "2026-09-04T18:19:29.019Z",
    "dateReserved": "2026-08-24T09:38:46.404Z",
    "dateUpdated": "2026-09-04T19:49:34.157Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-78327 (GCVE-0-2026-78327)

Vulnerability from nvd – Published: 2026-09-04 18:14 – Updated: 2026-09-04 19:50

Summary

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the underlying host, resulting in remote code execution.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-04 19:49 UTC

CWE

CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')

Assigner

sonicwall mitre root

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	Network Security Manager (NSM)	Affected: 4.3.0 and earlier versions

Date Public

2026-09-04 18:10

Credits

Andrei Lungu and Matei "Mal" Badanoiu of Pentest-Tools.com

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-78327",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T19:49:49.013441Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T19:50:05.348Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux",
            "On-Prem"
          ],
          "product": "Network Security Manager (NSM)",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "4.3.0 and earlier versions"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andrei Lungu and Matei \"Mal\" Badanoiu of Pentest-Tools.com"
        }
      ],
      "datePublic": "2026-09-04T18:10:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the underlying host, resulting in remote code execution."
            }
          ],
          "value": "An Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the underlying host, resulting in remote code execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T18:18:40.616Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0015"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0015",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-78327",
    "datePublished": "2026-09-04T18:14:54.641Z",
    "dateReserved": "2026-08-24T09:38:44.377Z",
    "dateUpdated": "2026-09-04T19:50:05.348Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66153 (GCVE-0-2026-66153)

Vulnerability from nvd – Published: 2026-08-25 20:01 – Updated: 2026-08-27 03:55

Summary

The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths.

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 00:00 UTC

CWE

CWE-59 - Improper link resolution before file access ('link following')

Assigner

sonicwall mitre root

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	NetExtender	Affected: 10.3.5 and earlier versions

Date Public

2026-08-25 19:51

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-66153",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-27T03:55:46.887Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux"
          ],
          "product": "NetExtender",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "10.3.5 and earlier versions"
            }
          ]
        }
      ],
      "datePublic": "2026-08-25T19:51:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths."
            }
          ],
          "value": "The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59 Improper link resolution before file access (\u0027link following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T20:01:15.598Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0013"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0013",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-66153",
    "datePublished": "2026-08-25T20:01:15.598Z",
    "dateReserved": "2026-07-24T08:34:11.798Z",
    "dateUpdated": "2026-08-27T03:55:46.887Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66152 (GCVE-0-2026-66152)

Vulnerability from nvd – Published: 2026-08-25 19:58 – Updated: 2026-08-31 16:20

Summary

A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 00:00 UTC

CWE

CWE-29 - Path traversal: '\..\filename'

Assigner

sonicwall mitre root

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	NetExtender	Affected: 10.3.5 and earlier versions

Date Public

2026-08-25 19:51

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-66152",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-27T03:55:45.806Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux"
          ],
          "product": "NetExtender",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "10.3.5 and earlier versions"
            }
          ]
        }
      ],
      "datePublic": "2026-08-25T19:51:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root."
            }
          ],
          "value": "A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-29",
              "description": "CWE-29 Path traversal: \u0027\\..\\filename\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T16:20:07.120Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0013"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0013",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-66152",
    "datePublished": "2026-08-25T19:58:47.474Z",
    "dateReserved": "2026-07-24T08:34:11.798Z",
    "dateUpdated": "2026-08-31T16:20:07.120Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66154 (GCVE-0-2026-66154)

Vulnerability from nvd – Published: 2026-08-11 20:12 – Updated: 2026-08-12 14:47

Summary

An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions which, under a successful MitM attack and controlled network conditions, could permit unauthorized changes.

Severity

8.3 (High)


                        
                          CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 04:00 UTC

CWE

CWE-295 - Improper certificate validation

Assigner

sonicwall mitre root

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	GMS	Affected: 9.5.1 and earlier versions

Date Public

2026-08-11 20:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-66154",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T04:00:37.248025Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T14:47:58.659Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux"
          ],
          "product": "GMS",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "9.5.1 and earlier versions"
            }
          ]
        }
      ],
      "datePublic": "2026-08-11T20:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions which, under a successful MitM attack and controlled network conditions, could permit unauthorized changes."
            }
          ],
          "value": "An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions which, under a successful MitM attack and controlled network conditions, could permit unauthorized changes."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295 Improper certificate validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T20:12:25.413Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0011",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-66154",
    "datePublished": "2026-08-11T20:12:25.413Z",
    "dateReserved": "2026-07-24T08:34:11.798Z",
    "dateUpdated": "2026-08-12T14:47:58.659Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66150 (GCVE-0-2026-66150)

Vulnerability from nvd – Published: 2026-08-11 20:19 – Updated: 2026-08-12 04:00

Summary

Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via SNMP.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 00:00 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

sonicwall mitre root

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	Email Security	Affected: 10.0.35.8405 and earlier versions

Date Public

2026-08-11 20:15

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-66150",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T04:00:40.772Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux"
          ],
          "product": "Email Security",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "10.0.35.8405 and earlier versions"
            }
          ]
        }
      ],
      "datePublic": "2026-08-11T20:15:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Control of Generation of Code (\u0027Code Injection\u0027) Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via SNMP."
            }
          ],
          "value": "Improper Control of Generation of Code (\u0027Code Injection\u0027) Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via SNMP."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T20:19:34.050Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0012"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0012",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-66150",
    "datePublished": "2026-08-11T20:19:34.050Z",
    "dateReserved": "2026-07-24T08:34:11.798Z",
    "dateUpdated": "2026-08-12T04:00:40.772Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66149 (GCVE-0-2026-66149)

Vulnerability from nvd – Published: 2026-08-11 20:18 – Updated: 2026-08-12 04:00

Summary

Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 00:00 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

sonicwall mitre root

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	Email Security	Affected: 10.0.35.8405 and earlier versions

Date Public

2026-08-11 20:15

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-66149",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T04:00:41.899Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux"
          ],
          "product": "Email Security",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "10.0.35.8405 and earlier versions"
            }
          ]
        }
      ],
      "datePublic": "2026-08-11T20:15:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Control of Generation of Code (\u0027Code Injection\u0027) Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask."
            }
          ],
          "value": "Improper Control of Generation of Code (\u0027Code Injection\u0027) Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T20:18:25.260Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0012"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0012",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-66149",
    "datePublished": "2026-08-11T20:18:25.260Z",
    "dateReserved": "2026-07-24T08:34:11.798Z",
    "dateUpdated": "2026-08-12T04:00:41.899Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66148 (GCVE-0-2026-66148)

Vulnerability from nvd – Published: 2026-08-11 20:10 – Updated: 2026-08-11 21:11

Summary

An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier versions which allows low-privileged local user to execute system commands with root privileges.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 21:10 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

sonicwall mitre root

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	GMS	Affected: 9.5.1 and earlier versions

Date Public

2026-08-11 20:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 6.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-66148",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T21:10:54.382299Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T21:11:09.052Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux"
          ],
          "product": "GMS",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "9.5.1 and earlier versions"
            }
          ]
        }
      ],
      "datePublic": "2026-08-11T20:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier versions which allows low-privileged local user to execute system commands with root privileges."
            }
          ],
          "value": "An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier versions which allows low-privileged local user to execute system commands with root privileges."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T20:10:39.663Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0011",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-66148",
    "datePublished": "2026-08-11T20:10:39.663Z",
    "dateReserved": "2026-07-24T08:34:11.798Z",
    "dateUpdated": "2026-08-11T21:11:09.052Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66147 (GCVE-0-2026-66147)

Vulnerability from nvd – Published: 2026-08-11 20:08 – Updated: 2026-08-12 14:46

Summary

An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests.

Severity

9.4 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 04:00 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

sonicwall mitre root

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	GMS	Affected: 9.5.1 and earlier versions

Date Public

2026-08-11 20:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.4,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "LOW",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-66147",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T04:00:43.777245Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T14:46:43.933Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Windows",
            "Linux"
          ],
          "product": "GMS",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "9.5.1 and earlier versions"
            }
          ]
        }
      ],
      "datePublic": "2026-08-11T20:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests."
            }
          ],
          "value": "An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T20:08:56.193Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0011",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-66147",
    "datePublished": "2026-08-11T20:08:56.193Z",
    "dateReserved": "2026-07-24T08:34:11.798Z",
    "dateUpdated": "2026-08-12T14:46:43.933Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-18634 (GCVE-0-2026-18634)

Vulnerability from nvd – Published: 2026-08-11 20:14 – Updated: 2026-08-12 17:28

Summary

An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions. A local attacker with the ability to interact with the service could exploit this behavior to perform unauthorized actions through the affected component.

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 04:00 UTC

CWE

CWE-502 - Deserialization of untrusted data

Assigner

sonicwall mitre root

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	GMS	Affected: 9.5.1 and earlier versions

Date Public

2026-08-11 20:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 8.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-18634",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T04:00:38.330155Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T17:28:11.678Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux"
          ],
          "product": "GMS",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "9.5.1 and earlier versions"
            }
          ]
        }
      ],
      "datePublic": "2026-08-11T20:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions. A local attacker with the ability to interact with the service could exploit this behavior to perform unauthorized actions through the affected component."
            }
          ],
          "value": "An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions. A local attacker with the ability to interact with the service could exploit this behavior to perform unauthorized actions through the affected component."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of untrusted data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T20:14:19.016Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0011",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-18634",
    "datePublished": "2026-08-11T20:14:19.016Z",
    "dateReserved": "2026-08-03T10:19:53.152Z",
    "dateUpdated": "2026-08-12T17:28:11.678Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66146 (GCVE-0-2026-66146)

Vulnerability from nvd – Published: 2026-08-11 20:07 – Updated: 2026-08-11 20:13

Summary

Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote attacker to execute javascript script in a user's browser.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 20:13 UTC

CWE

CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')

Assigner

sonicwall mitre root

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	GMS	Affected: 9.5.1 and earlier versions

Date Public

2026-08-11 20:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-66146",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T20:13:11.134840Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T20:13:29.530Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Windows",
            "Linux"
          ],
          "product": "GMS",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "9.5.1 and earlier versions"
            }
          ]
        }
      ],
      "datePublic": "2026-08-11T20:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote attacker to execute javascript script in a user\u0027s browser."
            }
          ],
          "value": "Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote attacker to execute javascript script in a user\u0027s browser."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T20:07:05.184Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0011",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-66146",
    "datePublished": "2026-08-11T20:07:05.184Z",
    "dateReserved": "2026-07-24T08:34:11.798Z",
    "dateUpdated": "2026-08-11T20:13:29.530Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66145 (GCVE-0-2026-66145)

Vulnerability from nvd – Published: 2026-08-11 20:05 – Updated: 2026-08-12 14:46

Summary

An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 04:00 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

sonicwall mitre root

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	GMS	Affected: 9.5.1 and earlier versions

Date Public

2026-08-11 20:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-66145",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T04:00:44.874926Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T14:46:28.752Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Windows",
            "Linux"
          ],
          "product": "GMS",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "9.5.1 and earlier versions"
            }
          ]
        }
      ],
      "datePublic": "2026-08-11T20:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip."
            }
          ],
          "value": "An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T20:05:18.939Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0011",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-66145",
    "datePublished": "2026-08-11T20:05:18.939Z",
    "dateReserved": "2026-07-24T08:34:11.798Z",
    "dateUpdated": "2026-08-12T14:46:28.752Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-81939 (GCVE-0-2026-81939)

Vulnerability from cvelistv5 – Published: 2026-09-04 18:22 – Updated: 2026-09-04 19:48

Summary

A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-04 19:47 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

sonicwall mitre root

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	Network Security Manager (NSM)	Affected: 4.3.0 and earlier versions

Date Public

2026-09-04 18:10

Credits

Andrei Lungu of Pentest-Tools.com

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-81939",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T19:47:14.778353Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T19:48:35.748Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux",
            "On-Prem"
          ],
          "product": "Network Security Manager (NSM)",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "4.3.0 and earlier versions"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Andrei Lungu of Pentest-Tools.com"
        }
      ],
      "datePublic": "2026-09-04T18:10:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive."
            }
          ],
          "value": "A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T18:22:16.711Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0015"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0015",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-81939",
    "datePublished": "2026-09-04T18:22:16.711Z",
    "dateReserved": "2026-08-27T19:48:11.225Z",
    "dateUpdated": "2026-09-04T19:48:35.748Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-78328 (GCVE-0-2026-78328)

Vulnerability from cvelistv5 – Published: 2026-09-04 18:19 – Updated: 2026-09-04 19:49

Summary

A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-04 19:49 UTC

CWE

CWE-862 - Missing Authorization

Assigner

sonicwall mitre root

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	Network Security Manager (NSM)	Affected: 4.3.0 and earlier versions

Date Public

2026-09-04 18:10

Credits

Andrei Lungu of Pentest-Tools.com

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-78328",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T19:49:15.329704Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T19:49:34.157Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux",
            "On-Prem"
          ],
          "product": "Network Security Manager (NSM)",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "4.3.0 and earlier versions"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Andrei Lungu of Pentest-Tools.com"
        }
      ],
      "datePublic": "2026-09-04T18:10:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin."
            }
          ],
          "value": "A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T18:19:29.019Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0015"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0015",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-78328",
    "datePublished": "2026-09-04T18:19:29.019Z",
    "dateReserved": "2026-08-24T09:38:46.404Z",
    "dateUpdated": "2026-09-04T19:49:34.157Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-78327 (GCVE-0-2026-78327)

Vulnerability from cvelistv5 – Published: 2026-09-04 18:14 – Updated: 2026-09-04 19:50

Summary

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the underlying host, resulting in remote code execution.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-04 19:49 UTC

CWE

CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')

Assigner

sonicwall mitre root

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	Network Security Manager (NSM)	Affected: 4.3.0 and earlier versions

Date Public

2026-09-04 18:10

Credits

Andrei Lungu and Matei "Mal" Badanoiu of Pentest-Tools.com

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-78327",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T19:49:49.013441Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T19:50:05.348Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux",
            "On-Prem"
          ],
          "product": "Network Security Manager (NSM)",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "4.3.0 and earlier versions"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Andrei Lungu and Matei \"Mal\" Badanoiu of Pentest-Tools.com"
        }
      ],
      "datePublic": "2026-09-04T18:10:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the underlying host, resulting in remote code execution."
            }
          ],
          "value": "An Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the underlying host, resulting in remote code execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T18:18:40.616Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0015"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0015",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-78327",
    "datePublished": "2026-09-04T18:14:54.641Z",
    "dateReserved": "2026-08-24T09:38:44.377Z",
    "dateUpdated": "2026-09-04T19:50:05.348Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66153 (GCVE-0-2026-66153)

Vulnerability from cvelistv5 – Published: 2026-08-25 20:01 – Updated: 2026-08-27 03:55

Summary

The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths.

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 00:00 UTC

CWE

CWE-59 - Improper link resolution before file access ('link following')

Assigner

sonicwall mitre root

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	NetExtender	Affected: 10.3.5 and earlier versions

Date Public

2026-08-25 19:51

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-66153",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-27T03:55:46.887Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux"
          ],
          "product": "NetExtender",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "10.3.5 and earlier versions"
            }
          ]
        }
      ],
      "datePublic": "2026-08-25T19:51:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths."
            }
          ],
          "value": "The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59 Improper link resolution before file access (\u0027link following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T20:01:15.598Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0013"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0013",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-66153",
    "datePublished": "2026-08-25T20:01:15.598Z",
    "dateReserved": "2026-07-24T08:34:11.798Z",
    "dateUpdated": "2026-08-27T03:55:46.887Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66152 (GCVE-0-2026-66152)

Vulnerability from cvelistv5 – Published: 2026-08-25 19:58 – Updated: 2026-08-31 16:20

Summary

A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 00:00 UTC

CWE

CWE-29 - Path traversal: '\..\filename'

Assigner

sonicwall mitre root

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	NetExtender	Affected: 10.3.5 and earlier versions

Date Public

2026-08-25 19:51

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-66152",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-27T03:55:45.806Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux"
          ],
          "product": "NetExtender",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "10.3.5 and earlier versions"
            }
          ]
        }
      ],
      "datePublic": "2026-08-25T19:51:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root."
            }
          ],
          "value": "A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-29",
              "description": "CWE-29 Path traversal: \u0027\\..\\filename\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T16:20:07.120Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0013"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0013",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-66152",
    "datePublished": "2026-08-25T19:58:47.474Z",
    "dateReserved": "2026-07-24T08:34:11.798Z",
    "dateUpdated": "2026-08-31T16:20:07.120Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66150 (GCVE-0-2026-66150)

Vulnerability from cvelistv5 – Published: 2026-08-11 20:19 – Updated: 2026-08-12 04:00

Summary

Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via SNMP.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 00:00 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

sonicwall mitre root

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	Email Security	Affected: 10.0.35.8405 and earlier versions

Date Public

2026-08-11 20:15

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-66150",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T04:00:40.772Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux"
          ],
          "product": "Email Security",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "10.0.35.8405 and earlier versions"
            }
          ]
        }
      ],
      "datePublic": "2026-08-11T20:15:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Control of Generation of Code (\u0027Code Injection\u0027) Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via SNMP."
            }
          ],
          "value": "Improper Control of Generation of Code (\u0027Code Injection\u0027) Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via SNMP."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T20:19:34.050Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0012"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0012",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-66150",
    "datePublished": "2026-08-11T20:19:34.050Z",
    "dateReserved": "2026-07-24T08:34:11.798Z",
    "dateUpdated": "2026-08-12T04:00:40.772Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66149 (GCVE-0-2026-66149)

Vulnerability from cvelistv5 – Published: 2026-08-11 20:18 – Updated: 2026-08-12 04:00

Summary

Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 00:00 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

sonicwall mitre root

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	Email Security	Affected: 10.0.35.8405 and earlier versions

Date Public

2026-08-11 20:15

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-66149",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T04:00:41.899Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux"
          ],
          "product": "Email Security",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "10.0.35.8405 and earlier versions"
            }
          ]
        }
      ],
      "datePublic": "2026-08-11T20:15:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Control of Generation of Code (\u0027Code Injection\u0027) Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask."
            }
          ],
          "value": "Improper Control of Generation of Code (\u0027Code Injection\u0027) Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T20:18:25.260Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0012"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0012",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-66149",
    "datePublished": "2026-08-11T20:18:25.260Z",
    "dateReserved": "2026-07-24T08:34:11.798Z",
    "dateUpdated": "2026-08-12T04:00:41.899Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-18634 (GCVE-0-2026-18634)

Vulnerability from cvelistv5 – Published: 2026-08-11 20:14 – Updated: 2026-08-12 17:28

Summary

An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions. A local attacker with the ability to interact with the service could exploit this behavior to perform unauthorized actions through the affected component.

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 04:00 UTC

CWE

CWE-502 - Deserialization of untrusted data

Assigner

sonicwall mitre root

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	GMS	Affected: 9.5.1 and earlier versions

Date Public

2026-08-11 20:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 8.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-18634",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T04:00:38.330155Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T17:28:11.678Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux"
          ],
          "product": "GMS",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "9.5.1 and earlier versions"
            }
          ]
        }
      ],
      "datePublic": "2026-08-11T20:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions. A local attacker with the ability to interact with the service could exploit this behavior to perform unauthorized actions through the affected component."
            }
          ],
          "value": "An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions. A local attacker with the ability to interact with the service could exploit this behavior to perform unauthorized actions through the affected component."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of untrusted data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T20:14:19.016Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0011",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-18634",
    "datePublished": "2026-08-11T20:14:19.016Z",
    "dateReserved": "2026-08-03T10:19:53.152Z",
    "dateUpdated": "2026-08-12T17:28:11.678Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66154 (GCVE-0-2026-66154)

Vulnerability from cvelistv5 – Published: 2026-08-11 20:12 – Updated: 2026-08-12 14:47

Summary

An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions which, under a successful MitM attack and controlled network conditions, could permit unauthorized changes.

Severity

8.3 (High)


                        
                          CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 04:00 UTC

CWE

CWE-295 - Improper certificate validation

Assigner

sonicwall mitre root

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	GMS	Affected: 9.5.1 and earlier versions

Date Public

2026-08-11 20:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-66154",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T04:00:37.248025Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T14:47:58.659Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux"
          ],
          "product": "GMS",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "9.5.1 and earlier versions"
            }
          ]
        }
      ],
      "datePublic": "2026-08-11T20:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions which, under a successful MitM attack and controlled network conditions, could permit unauthorized changes."
            }
          ],
          "value": "An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions which, under a successful MitM attack and controlled network conditions, could permit unauthorized changes."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295 Improper certificate validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T20:12:25.413Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0011",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-66154",
    "datePublished": "2026-08-11T20:12:25.413Z",
    "dateReserved": "2026-07-24T08:34:11.798Z",
    "dateUpdated": "2026-08-12T14:47:58.659Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66148 (GCVE-0-2026-66148)

Vulnerability from cvelistv5 – Published: 2026-08-11 20:10 – Updated: 2026-08-11 21:11

Summary

An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier versions which allows low-privileged local user to execute system commands with root privileges.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 21:10 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

sonicwall mitre root

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	GMS	Affected: 9.5.1 and earlier versions

Date Public

2026-08-11 20:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 6.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-66148",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T21:10:54.382299Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T21:11:09.052Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux"
          ],
          "product": "GMS",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "9.5.1 and earlier versions"
            }
          ]
        }
      ],
      "datePublic": "2026-08-11T20:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier versions which allows low-privileged local user to execute system commands with root privileges."
            }
          ],
          "value": "An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier versions which allows low-privileged local user to execute system commands with root privileges."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T20:10:39.663Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0011",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-66148",
    "datePublished": "2026-08-11T20:10:39.663Z",
    "dateReserved": "2026-07-24T08:34:11.798Z",
    "dateUpdated": "2026-08-11T21:11:09.052Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66147 (GCVE-0-2026-66147)

Vulnerability from cvelistv5 – Published: 2026-08-11 20:08 – Updated: 2026-08-12 14:46

Summary

An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests.

Severity

9.4 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 04:00 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

sonicwall mitre root

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	GMS	Affected: 9.5.1 and earlier versions

Date Public

2026-08-11 20:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.4,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "LOW",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-66147",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T04:00:43.777245Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T14:46:43.933Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Windows",
            "Linux"
          ],
          "product": "GMS",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "9.5.1 and earlier versions"
            }
          ]
        }
      ],
      "datePublic": "2026-08-11T20:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests."
            }
          ],
          "value": "An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T20:08:56.193Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0011",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-66147",
    "datePublished": "2026-08-11T20:08:56.193Z",
    "dateReserved": "2026-07-24T08:34:11.798Z",
    "dateUpdated": "2026-08-12T14:46:43.933Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66146 (GCVE-0-2026-66146)

Vulnerability from cvelistv5 – Published: 2026-08-11 20:07 – Updated: 2026-08-11 20:13

Summary

Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote attacker to execute javascript script in a user's browser.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 20:13 UTC

CWE

CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')

Assigner

sonicwall mitre root

References

1 reference

URL	Tags
https://psirt.global.sonicwall.com/vuln-detail/SN…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
SonicWall	GMS	Affected: 9.5.1 and earlier versions

Date Public

2026-08-11 20:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-66146",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T20:13:11.134840Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T20:13:29.530Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Windows",
            "Linux"
          ],
          "product": "GMS",
          "vendor": "SonicWall",
          "versions": [
            {
              "status": "affected",
              "version": "9.5.1 and earlier versions"
            }
          ]
        }
      ],
      "datePublic": "2026-08-11T20:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote attacker to execute javascript script in a user\u0027s browser."
            }
          ],
          "value": "Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote attacker to execute javascript script in a user\u0027s browser."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T20:07:05.184Z",
        "orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
        "shortName": "sonicwall"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011"
        }
      ],
      "source": {
        "advisory": "SNWLID-2026-0011",
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
    "assignerShortName": "sonicwall",
    "cveId": "CVE-2026-66146",
    "datePublished": "2026-08-11T20:07:05.184Z",
    "dateReserved": "2026-07-24T08:34:11.798Z",
    "dateUpdated": "2026-08-11T20:13:29.530Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CERTFR-2026-AVI-1115

Vulnerability from certfr_avis - Published: 2026-09-04 - Updated: 2026-09-04

De multiples vulnérabilités ont été découvertes dans Sonicwall Network Security Manager. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Sonicwall	Network Security Manager	Network Security Manager On-Prem (VMWare, Hyper-V, Azure et KVM) versions antérieures à 4.3.1-R4

References

Title

Publication Time

Tags

Bulletin de sécurité SonicWall SNWLID-2026-0015

2026-09-03

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Network Security Manager On-Prem (VMWare, Hyper-V, Azure et KVM) versions ant\u00e9rieures \u00e0 4.3.1-R4",
      "product": {
        "name": "Network Security Manager",
        "vendor": {
          "name": "Sonicwall",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-81939",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81939"
    },
    {
      "name": "CVE-2026-78328",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78328"
    },
    {
      "name": "CVE-2026-78327",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78327"
    }
  ],
  "initial_release_date": "2026-09-04T00:00:00",
  "last_revision_date": "2026-09-04T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1115",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-09-04T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Sonicwall Network Security Manager. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Sonicwall Network Security Manager",
  "vendor_advisories": [
    {
      "published_at": "2026-09-03",
      "title": "Bulletin de s\u00e9curit\u00e9 SonicWall SNWLID-2026-0015",
      "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0015"
    }
  ]
}

CERTFR-2026-AVI-1103

Vulnerability from certfr_avis - Published: 2026-09-02 - Updated: 2026-09-02

De multiples vulnérabilités ont été découvertes dans les produits SonicWall. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et une falsification de requêtes côté serveur (SSRF).

L'éditeur indique que les vulnérabilités CVE-2026-83548 et CVE-2026-83549 sont activement exploités.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Sonicwall	Secure Mobile Access	Modèles SMA1000 6210, 7210 et 8200v versions antérieures à 12.4.3-03526
	Sonicwall	Secure Mobile Access	Modèles SMA1000 6210, 7210 et 8200v versions 12.5.x antérieures à 12.5.0-02952

References

Title

Publication Time

Tags

Bulletin de sécurité SonicWall SNWLID-2026-0016

2026-09-01

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Mod\u00e8les SMA1000 6210, 7210 et 8200v versions ant\u00e9rieures \u00e0 12.4.3-03526",
      "product": {
        "name": "Secure Mobile Access",
        "vendor": {
          "name": "Sonicwall",
          "scada": false
        }
      }
    },
    {
      "description": "Mod\u00e8les SMA1000 6210, 7210 et 8200v versions 12.5.x ant\u00e9rieures \u00e0 12.5.0-02952",
      "product": {
        "name": "Secure Mobile Access",
        "vendor": {
          "name": "Sonicwall",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-83549",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-83549"
    },
    {
      "name": "CVE-2026-83548",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-83548"
    }
  ],
  "initial_release_date": "2026-09-02T00:00:00",
  "last_revision_date": "2026-09-02T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1103",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-09-02T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SonicWall. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance et une falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF).\n\nL\u0027\u00e9diteur indique que les vuln\u00e9rabilit\u00e9s CVE-2026-83548 et CVE-2026-83549 sont activement exploit\u00e9s.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SonicWall",
  "vendor_advisories": [
    {
      "published_at": "2026-09-01",
      "title": "Bulletin de s\u00e9curit\u00e9 SonicWall SNWLID-2026-0016",
      "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016"
    }
  ]
}

CERTFR-2026-AVI-1084

Vulnerability from certfr_avis - Published: 2026-08-26 - Updated: 2026-08-26

De multiples vulnérabilités ont été découvertes dans SonicWall NetExtender. Elles permettent à un attaquant de provoquer un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Sonicwall	NetExtender	NetExtender Linux Client versions antérieures à 10.3.6

References

Title

Publication Time

Tags

Bulletin de sécurité SonicWall SNWLID-2026-0013

2026-08-25

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "NetExtender Linux Client versions ant\u00e9rieures \u00e0 10.3.6",
      "product": {
        "name": "NetExtender",
        "vendor": {
          "name": "Sonicwall",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-66152",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66152"
    },
    {
      "name": "CVE-2026-66153",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66153"
    }
  ],
  "initial_release_date": "2026-08-26T00:00:00",
  "last_revision_date": "2026-08-26T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1084",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-08-26T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans SonicWall NetExtender. Elles permettent \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans SonicWall NetExtender",
  "vendor_advisories": [
    {
      "published_at": "2026-08-25",
      "title": "Bulletin de s\u00e9curit\u00e9 SonicWall SNWLID-2026-0013",
      "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0013"
    }
  ]
}

CERTFR-2026-AVI-1006

Vulnerability from certfr_avis - Published: 2026-08-12 - Updated: 2026-08-12

De multiples vulnérabilités ont été découvertes dans les produits SonicWall. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Sonicwall	Email Security	Email Security versions antérieures à 10.0.36
	Sonicwall	N/A	GMS versions antérieures à 9.5.2

References

Title

Publication Time

Tags

Bulletin de sécurité SonicWall SNWLID-2026-0012	2026-08-11	vendor-advisory
Bulletin de sécurité SonicWall SNWLID-2026-0011	2026-08-11	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Email Security versions ant\u00e9rieures \u00e0 10.0.36",
      "product": {
        "name": "Email Security",
        "vendor": {
          "name": "Sonicwall",
          "scada": false
        }
      }
    },
    {
      "description": "GMS versions ant\u00e9rieures \u00e0 9.5.2 ",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Sonicwall",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-66150",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66150"
    },
    {
      "name": "CVE-2026-66154",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66154"
    },
    {
      "name": "CVE-2026-66148",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66148"
    },
    {
      "name": "CVE-2026-66149",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66149"
    },
    {
      "name": "CVE-2026-66147",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66147"
    },
    {
      "name": "CVE-2026-66146",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66146"
    },
    {
      "name": "CVE-2026-18634",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18634"
    },
    {
      "name": "CVE-2026-66145",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66145"
    }
  ],
  "initial_release_date": "2026-08-12T00:00:00",
  "last_revision_date": "2026-08-12T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1006",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-08-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SonicWall. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits SonicWall",
  "vendor_advisories": [
    {
      "published_at": "2026-08-11",
      "title": "Bulletin de s\u00e9curit\u00e9 SonicWall SNWLID-2026-0012",
      "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0012"
    },
    {
      "published_at": "2026-08-11",
      "title": "Bulletin de s\u00e9curit\u00e9 SonicWall SNWLID-2026-0011",
      "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011"
    }
  ]
}

CERTFR-2026-ALE-009

Vulnerability from certfr_alerte - Published: 2026-09-02 - Updated: 2026-09-02

Le 01 septembre 2026, SonicWall a publié un avis de sécurité concernant deux vulnérabilités affectant les Secure Mobile Access (SMA) 1000.

La vulnérabilité critique CVE-2026-83548 permet une falsification de requêtes côté serveur (SSRF) de la part d'un attaquant non authentifié.

La vulnérabilité CVE-2026-83549 permet à un attaquant authentifié avec les droits administrateur d'exécuter du code arbitraire à distance.

L'éditeur indique que ces deux vulnérabilités sont activement exploitées, sans préciser s'il est possible pour un attaquant non authentifié de chaîner l'exploitation de ces deux vulnérabilités pour prendre la main sur l'équipement.

L'obtention des marqueurs de compromission se fait en contactant le support technique de SonicWall.

L'application des correctifs n'est pas suffisante. En effet, l'éditeur recommande de :

réinstaller le système ;
changer tous les mots de passe utilisateurs et administrateurs ;
réinitialiser les mots de passe à usage unique basé sur le temps (TOTP, Time based One Time Password).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Sonicwall	Secure Mobile Access	Modèles SMA1000 6210, 7210 et 8200v versions antérieures à 12.4.3-03526
	Sonicwall	Secure Mobile Access	Modèles SMA1000 6210, 7210 et 8200v versions 12.5.x antérieures à 12.5.0-02952

References

Title

Publication Time

Tags

Bulletin de sécurité SonicWall SNWLID-2026-0016	2026-09-01	vendor-advisory
Communication SonicWall du 01 septembre 2026	-	other
Avis CERT-FR CERTFR-2026-AVI-1103 du 01 septembre 2026	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Mod\u00e8les SMA1000 6210, 7210 et 8200v versions ant\u00e9rieures \u00e0 12.4.3-03526",
      "product": {
        "name": "Secure Mobile Access",
        "vendor": {
          "name": "Sonicwall",
          "scada": false
        }
      }
    },
    {
      "description": "Mod\u00e8les SMA1000 6210, 7210 et 8200v versions 12.5.x ant\u00e9rieures \u00e0 12.5.0-02952",
      "product": {
        "name": "Secure Mobile Access",
        "vendor": {
          "name": "Sonicwall",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "closed_at": null,
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-83549",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-83549"
    },
    {
      "name": "CVE-2026-83548",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-83548"
    }
  ],
  "initial_release_date": "2026-09-02T00:00:00",
  "last_revision_date": "2026-09-02T00:00:00",
  "links": [
    {
      "title": "Communication SonicWall du 01 septembre 2026",
      "url": "https://www.sonicwall.com/support/notices/product-notice-sma-1000-series-affected-by-multiple-vulnerabilities-snwlid-2026-0016/kA1VN000002AXmQ0AW"
    },
    {
      "title": "Avis CERT-FR CERTFR-2026-AVI-1103 du 01 septembre 2026",
      "url": " https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1103/ "
    }
  ],
  "reference": "CERTFR-2026-ALE-009",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-09-02T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
    }
  ],
  "summary": "Le 01 septembre 2026, SonicWall a publi\u00e9 un avis de s\u00e9curit\u00e9 concernant deux vuln\u00e9rabilit\u00e9s affectant les Secure Mobile Access (SMA) 1000.\n\nLa vuln\u00e9rabilit\u00e9 critique CVE-2026-83548 permet une falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF) de la part d\u0027un attaquant non authentifi\u00e9.\n\nLa vuln\u00e9rabilit\u00e9 CVE-2026-83549 permet \u00e0 un attaquant authentifi\u00e9 avec les droits administrateur d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance.\n\nL\u0027\u00e9diteur indique que ces deux vuln\u00e9rabilit\u00e9s sont activement exploit\u00e9es, sans pr\u00e9ciser s\u0027il est possible pour un attaquant non authentifi\u00e9 de cha\u00eener l\u0027exploitation de ces deux vuln\u00e9rabilit\u00e9s pour prendre la main sur l\u0027\u00e9quipement.\n\nL\u0027obtention des marqueurs de compromission se fait en contactant le support technique de SonicWall.\n\nL\u0027application des correctifs n\u0027est pas suffisante. En effet, l\u0027\u00e9diteur recommande de :\n\u003cul\u003e\n\u003cli\u003er\u00e9installer le syst\u00e8me ; \u003c/li\u003e\n\u003cli\u003echanger tous les mots de passe utilisateurs et administrateurs ; \u003c/li\u003e\n\u003cli\u003er\u00e9initialiser les mots de passe \u00e0 usage unique bas\u00e9 sur le temps (\u003ci\u003eTOTP\u003c/i\u003e, \u003ci\u003eTime based One Time Password\u003c/i\u003e).\u003c/li\u003e\n\u003c/ul\u003e\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans SonicWall Secure Mobile Access",
  "vendor_advisories": [
    {
      "published_at": "2026-09-01",
      "title": "Bulletin de s\u00e9curit\u00e9 SonicWall SNWLID-2026-0016",
      "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016"
    }
  ]
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

730 vulnerabilities by SonicWall

CVE-2026-81939 (GCVE-0-2026-81939)

CVE-2026-78328 (GCVE-0-2026-78328)

CVE-2026-78327 (GCVE-0-2026-78327)

CVE-2026-66153 (GCVE-0-2026-66153)

CVE-2026-66152 (GCVE-0-2026-66152)

CVE-2026-66154 (GCVE-0-2026-66154)

CVE-2026-66150 (GCVE-0-2026-66150)

CVE-2026-66149 (GCVE-0-2026-66149)

CVE-2026-66148 (GCVE-0-2026-66148)

CVE-2026-66147 (GCVE-0-2026-66147)

CVE-2026-18634 (GCVE-0-2026-18634)

CVE-2026-66146 (GCVE-0-2026-66146)

CVE-2026-66145 (GCVE-0-2026-66145)

CVE-2026-81939 (GCVE-0-2026-81939)

CVE-2026-78328 (GCVE-0-2026-78328)

CVE-2026-78327 (GCVE-0-2026-78327)

CVE-2026-66153 (GCVE-0-2026-66153)

CVE-2026-66152 (GCVE-0-2026-66152)

CVE-2026-66150 (GCVE-0-2026-66150)

CVE-2026-66149 (GCVE-0-2026-66149)

CVE-2026-18634 (GCVE-0-2026-18634)

CVE-2026-66154 (GCVE-0-2026-66154)

CVE-2026-66148 (GCVE-0-2026-66148)

CVE-2026-66147 (GCVE-0-2026-66147)

CVE-2026-66146 (GCVE-0-2026-66146)

CERTFR-2026-AVI-1115

Solutions

CERTFR-2026-AVI-1103

Solutions

CERTFR-2026-AVI-1084

Solutions

CERTFR-2026-AVI-1006

Solutions

CERTFR-2026-ALE-009

Solutions

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

730 vulnerabilities by SonicWall

CVE-2026-81939 (GCVE-0-2026-81939)

CVE-2026-78328 (GCVE-0-2026-78328)

CVE-2026-78327 (GCVE-0-2026-78327)

CVE-2026-66153 (GCVE-0-2026-66153)

CVE-2026-66152 (GCVE-0-2026-66152)

CVE-2026-66154 (GCVE-0-2026-66154)

CVE-2026-66150 (GCVE-0-2026-66150)

CVE-2026-66149 (GCVE-0-2026-66149)

CVE-2026-66148 (GCVE-0-2026-66148)

CVE-2026-66147 (GCVE-0-2026-66147)

CVE-2026-18634 (GCVE-0-2026-18634)

CVE-2026-66146 (GCVE-0-2026-66146)

CVE-2026-66145 (GCVE-0-2026-66145)

CVE-2026-81939 (GCVE-0-2026-81939)

CVE-2026-78328 (GCVE-0-2026-78328)

CVE-2026-78327 (GCVE-0-2026-78327)

CVE-2026-66153 (GCVE-0-2026-66153)

CVE-2026-66152 (GCVE-0-2026-66152)

CVE-2026-66150 (GCVE-0-2026-66150)

CVE-2026-66149 (GCVE-0-2026-66149)

CVE-2026-18634 (GCVE-0-2026-18634)

CVE-2026-66154 (GCVE-0-2026-66154)

CVE-2026-66148 (GCVE-0-2026-66148)

CVE-2026-66147 (GCVE-0-2026-66147)

CVE-2026-66146 (GCVE-0-2026-66146)

CERTFR-2026-AVI-1115

Solutions

CERTFR-2026-AVI-1103

Solutions

CERTFR-2026-AVI-1084

Solutions

CERTFR-2026-AVI-1006

Solutions

CERTFR-2026-ALE-009

Solutions

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.