SonicWall Email Security CVE-2026-66150

Exploitation requires two concrete prerequisites: (1) the attacker must hold valid credentials granting access to the SonicWall Email Security restricted CLI - confirmed by the CVSS PR:L designation, meaning standard (non-administrative) CLI credentials suffice; (2) the SNMP functionality must be accessible or invokable from within the restricted CLI session, which is the default configuration for this appliance class. The CVSS AV:L confirms that the attack vector is local - the CLI must be reachable, typically via SSH to the management interface. Exploitation is not automatable per SSVC, as it requires an interactive CLI session. The primary limiting factors are: the need for valid CLI credentials (no unauthenticated path exists per the CVSS vector), local/CLI reachability of the management interface (not a direct internet-facing remote attack), and the requirement for manual interaction. No special OS configuration or feature toggle beyond default appliance setup is indicated as required.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a local, low-complexity attack requiring only restricted CLI credentials - not administrative rights - with no user interaction. This is consistent with the SSVC classification: Exploitation: none (no active exploitation confirmed), Automatable: no (requires a manual interactive CLI session), Technical Impact: total (full root-level compromise). The combination of low attack complexity and total impact means that any organization granting CLI access to non-administrative or shared service accounts faces material risk. EPSS data was not provided in the intelligence feed, so probabilistic exploitation likelihood cannot be quantified here. There is no CISA KEV listing and no known public POC at time of analysis, which moderates urgency relative to the CVSS score alone. However, the straightforward nature of command injection - once CLI access exists - means the practical barrier to exploitation is low for any attacker who already holds restricted CLI credentials. The absence of network-level exploitability (AV:L) is the primary limiting factor for mass exploitation.

An attacker who has obtained valid restricted CLI credentials - via phishing, credential reuse, or insider access - authenticates to the SonicWall Email Security appliance over SSH. They issue a crafted SNMP-related CLI command with injected shell metacharacters (e.g., backticks or semicolons) in an argument field. The appliance passes the unsanitized input directly to an OS command, executing the injected payload as root and granting the attacker full control of the appliance operating system. No public POC is known at time of analysis.