EUVD-2026-56947
GHSA-q28x-3mgc-vv69
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector because exploitation requires CLI session access; PR:L because restricted (non-admin) CLI credentials suffice; full C/I/A because root-level code execution is achieved.
Primary rating from Vendor (sonicwall).
CVSS VectorVendor: sonicwall
Lifecycle Timeline
2DescriptionCVE.org
Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via SNMP.
AnalysisAI
OS command injection via the SNMP-handling code path in SonicWall Email Security 10.0.35.8405 and earlier grants a low-privileged, authenticated CLI user root-level code execution on the underlying appliance OS. The restricted CLI fails to sanitize user-supplied input before passing it to SNMP-related system commands, enabling full host compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concrete prerequisites: (1) the attacker must hold valid credentials granting access to the SonicWall Email Security restricted CLI - confirmed by the CVSS PR:L designation, meaning standard (non-administrative) CLI credentials suffice; (2) the SNMP functionality must be accessible or invokable from within the restricted CLI session, which is the default configuration for this appliance class. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a local, low-complexity attack requiring only restricted CLI credentials - not administrative rights - with no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the vendor-released patch per SonicWall advisory SNWLID-2026-0012 at https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0012, upgrading beyond the affected boundary of version 10.0.35.8405. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all SonicWall Email Security instances to identify those running version 10.0.35.8405 or earlier and audit which user accounts hold CLI access to determine exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Email Security
View allApache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload a
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Forcepoint Cloud S
Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Loss
A configuration issue has been discovered in Forcepoint Email Security 8.4.x and 8.5.x: the product is left in a vulnera
OS command injection in SonicWall Email Security (versions 10.0.35.8405 and earlier) allows an authenticated restricted
The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Email S
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today