SonicWall Email Security CVE-2026-66149

Exploitation requires authenticated access to the SonicWall Email Security restricted CLI - the attacker must possess valid credentials for an account that has been granted CLI access on the appliance. This is confirmed by CVSS PR:L (low-privilege authenticated) and AV:L (local attack vector). The specific injection point is the netmask parameter within the restricted CLI; exploitation is only possible when interacting with this parameter. Remote unauthenticated exploitation is not possible given AV:L. No special non-default configuration is required beyond the attacker having CLI-level access; the vulnerability exists in the default CLI handling of the netmask input. Exploitation is limited to users or processes that can authenticate to the restricted CLI - this rules out external, unauthenticated internet-based attackers unless initial access has already been established through another means.

The CVSS 7.8 score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects the risk profile: local attack vector requires existing authenticated CLI access, which significantly limits the attacker population compared to a network-exploitable flaw. SSVC assessment from CISA rates exploitation as 'none' and automatable as 'no', meaning mass exploitation is not feasible and no active campaigns are known. Technical impact is rated 'total' by SSVC, consistent with root-level code execution. EPSS data is not present in the provided intelligence, so statistical exploitation probability cannot be quantified. The realistic threat actor is an insider, a compromised service account with CLI privileges, or an attacker who has already achieved initial access via a separate vector. Despite the restricted attack surface, organizations operating SonicWall Email Security appliances should treat this as a high-priority patch given the complete system compromise potential once CLI access is achieved.

An attacker who has compromised a low-privilege account with access to the SonicWall Email Security restricted CLI - whether through credential theft, phishing a network administrator, or lateral movement from an already-compromised internal host - connects to the CLI and supplies a crafted netmask value containing shell metacharacters (e.g., semicolons or backtick substitution). The appliance processes the parameter without sanitization, executing the injected payload as root, giving the attacker full control of the appliance including access to all processed email, stored credentials, and the ability to pivot further into the organization's network.