EUVD-2026-56946
GHSA-c646-hgff-p944
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AV:L and PR:L reflect mandatory CLI authentication on a local appliance interface; root execution stays within the same system boundary, so S:U applies.
Primary rating from Vendor (sonicwall).
CVSS VectorVendor: sonicwall
Lifecycle Timeline
2DescriptionCVE.org
Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask.
AnalysisAI
OS command injection in SonicWall Email Security (versions 10.0.35.8405 and earlier) allows an authenticated restricted CLI user to execute arbitrary commands as root via a crafted netmask parameter. The CVSS 7.8 score reflects complete confidentiality, integrity, and availability impact despite requiring local CLI access and low-level privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires authenticated access to the SonicWall Email Security restricted CLI - the attacker must possess valid credentials for an account that has been granted CLI access on the appliance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects the risk profile: local attack vector requires existing authenticated CLI access, which significantly limits the attacker population compared to a network-exploitable flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade SonicWall Email Security beyond version 10.0.35.8405; the exact patched version is not independently confirmed in the available data and must be obtained from the vendor advisory at https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0012. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all SonicWall Email Security deployments and identify those running version 10.0.35.8405 or earlier; audit current CLI user accounts and immediately restrict access to only essential administrative staff with documented business justification and approval. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Email Security
View allApache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload a
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Forcepoint Cloud S
Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Loss
A configuration issue has been discovered in Forcepoint Email Security 8.4.x and 8.5.x: the product is left in a vulnera
OS command injection via the SNMP-handling code path in SonicWall Email Security 10.0.35.8405 and earlier grants a low-p
The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Email S
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today