SonicWall Global VPN Client CVE-2026-66151

Exploitation requires a local, authenticated session on a Windows host where SonicWall Global VPN Client version 4.10.8.1108 or earlier is installed and the SWIPsec.sys driver is loaded. The CVSS PR:L metric confirms standard user-level privileges are sufficient - no administrative rights are needed. No network exposure is required (AV:L), and no user interaction beyond the attacker's own actions is necessary (UI:N). Limiting factors include the mandatory local access requirement, the absence of any confidentiality or integrity impact (restricting utility to disruptive denial-of-service), and the need for the VPN client to be installed and its driver active on the target host.

The CVSS 3.1 base score of 5.5 (Medium) is well-calibrated for this vulnerability. The vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H confirms the impact is strictly a local denial-of-service: no confidentiality or integrity loss, no scope change, and exploitation requires a local session with at minimum low-privilege credentials. EPSS at 0.16% (5th percentile) reinforces that there is negligible exploitation interest in the wild, and there is no CISA KEV entry. The tags supplied include 'Information Disclosure,' which is inconsistent with the CVSS C:N metric and the description limiting impact to a system crash - this discrepancy should be verified with the vendor advisory; at present, no confidentiality impact is confirmed. The net real-world risk is low-to-moderate: endpoints running the SonicWall VPN client are affected, but exploitation requires local access and yields only a DoS, limiting its utility to insider threat or post-compromise persistence disruption scenarios.

An attacker who has already gained a low-privilege local session on a Windows endpoint - via phishing, credential stuffing, or insider access - crafts an interaction with the SWIPsec.sys kernel driver to trigger the out-of-bounds read, causing an immediate kernel panic and forcing a system reboot. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) suggests that once the precise driver interaction is identified, exploitation would be straightforward.