What is the CVSS score of EUVD-2026-56946?

EUVD-2026-56946 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of SonicWall Email Security are affected by EUVD-2026-56946?

SonicWall Email Security versions 10.0.35.8405 and earlier contain an authenticated command injection vulnerability allowing restricted CLI users to execute arbitrary commands as root, resulting in…

How to fix or mitigate EUVD-2026-56946?

Within 24 hours: Inventory all SonicWall Email Security deployments and identify those running version 10.0.35.8405 or earlier; audit current CLI user accounts and immediately restrict access to only essential administrative staff with documented business justification and approval. Within 7 days: Implement multi-factor authentication for CLI access if available, enable and centralize CLI audit logging with real-time alerting for suspicious command execution patterns, and document all access control changes. Within 30 days: Establish continuous monitoring of SonicWall security advisories for patch releases; develop and begin testing an upgrade strategy to versions newer than 10.0.35.8405, with priority escalation due to full-appliance compromise severity.

SonicWall Email Security EUVD-2026-56946

| CVE-2026-66149 HIGH

Code Injection (CWE-94)

2026-08-11 sonicwall

GHSA-c646-hgff-p944

RCE Code Injection Sonicwall Email Security

7.8

CVSS 3.1 · Vendor: sonicwall

Severity by source

Vendor (sonicwall) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

AV:L and PR:L reflect mandatory CLI authentication on a local appliance interface; root execution stays within the same system boundary, so S:U applies.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (sonicwall).

CVSS VectorVendor: sonicwall

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 23:37 vuln.today

CVE Published

Aug 11, 2026 - 20:18 cve.org

HIGH 7.8

DescriptionCVE.org

Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask.

AnalysisAI

OS command injection in SonicWall Email Security (versions 10.0.35.8405 and earlier) allows an authenticated restricted CLI user to execute arbitrary commands as root via a crafted netmask parameter. The CVSS 7.8 score reflects complete confidentiality, integrity, and availability impact despite requiring local CLI access and low-level privileges. No public exploit code exists and CISA SSVC indicates no known exploitation at time of analysis, though successful exploitation yields full appliance compromise.

Technical ContextAI

The vulnerability is classified as CWE-94 (Improper Control of Generation of Code - Code Injection), specifically OS command injection within SonicWall Email Security's restricted CLI interface. The restricted CLI is a constrained shell environment intended to limit what authenticated users can do on the appliance. The netmask parameter processed by this CLI fails to sanitize user-supplied input before it is incorporated into OS-level command execution, allowing an attacker to append or inject shell metacharacters that cause arbitrary commands to run in the context of the root user. CPE cpe:2.3:a:sonicwall:email_security:*:*:*:*:*:*:*:* identifies the affected component as the SonicWall Email Security software application on its dedicated appliance platform. This class of flaw typically occurs when CLI handlers construct OS commands via string interpolation rather than parameterized argument passing.

RemediationAI

The primary remediation is to upgrade SonicWall Email Security beyond version 10.0.35.8405; the exact patched version is not independently confirmed in the available data and must be obtained from the vendor advisory at https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0012. As a compensating control prior to patching, restrict CLI access strictly to a minimal set of trusted administrators - audit which accounts hold CLI privileges and revoke any that are unnecessary, since the vulnerability requires authenticated CLI access to exploit. Additionally, enable logging and alerting on CLI sessions to detect anomalous netmask parameter usage. Note that restricting CLI access does not eliminate the vulnerability; it only reduces the attacker population and buys time until the patch can be applied.