EUVD-2026-94326
GHSA-5vfm-g74w-hp7p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain admin access to AMC interface
-
DeliveryUpload crafted Zip Slip archive
-
ExploitTraversal writes file outside target directory
-
ExecutionOverwrite executable/config path
-
ImpactExecute arbitrary code on appliance
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session with high/administrative privileges on the SMA1000 Appliance Management Console (AMC) and the ability to supply or upload a crafted archive that the AMC extracts. The CVSS vector's PR:H confirms the attacker must already possess admin-level access, which is the primary limiting factor and sharply narrows realistic attackers to compromised or malicious administrators. Affected deployments are SonicWall SMA1000 running 12.5.0-02952 (platform-hotfix) and 12.4.3-03526 (platform-hotfix) and older; no special non-default feature toggle is indicated, but the archive-extraction code path in the AMC must be reachable with those credentials. |
| Impact | This is a genuine high-severity but conditional issue rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) describes network-reachable, low-complexity exploitation with total CIA impact (RCE), but critically requires PR:H - high (administrative) privileges on the SMA1000 Appliance Management Console. All opportunistic/automatable risk signals point low: CISA SSVC lists Exploitation='none' and Automatable='no' (consistent with the PR:H gate requiring an authenticated admin), while Technical Impact='total' matches the RCE outcome. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or widespread exploitation. The signals are internally consistent: the high technical impact is offset by the administrative-privilege prerequisite, so the realistic risk is primarily post-authentication privilege-to-code-execution or an admin-account-compromise escalation path, not an internet-facing unauthenticated takeover. Priority should be driven by the fact that this is a security appliance (compromise = foothold on a security control) and by patch availability, not by raw CVSS alone. |
| Exploit ScenarioDerived | An attacker who already holds (or has compromised) an administrative session on the SMA1000 AMC uploads a specially crafted archive whose entries use path-traversal filenames (Zip Slip). On extraction the appliance writes files outside the intended directory, overwriting an executable or configuration path and achieving remote code execution on the appliance. No public exploit code was identified at time of analysis, and the attack requires high administrative privileges. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Remote code execution in SonicWall SMA1000 (Appliance Management Console) can be triggered by an authenticated administrator who uploads a crafted archive containing path traversal sequences, allowing files to be written outside the intended extraction directory and leading to code execution. The vulnerability is a classic Zip Slip (CWE-22) issue with a CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning an attacker must already hold high/administrative privileges on the AMC-a significant precondition that sharply limits the pool of realistic attackers to compromised or malicious administrators. No public exploit code or active exploitation has been identified at time of analysis (SSVC exploitation: none), so this is a conditional high-severity risk rather than a mass-exploitation emergency.
RemediationAI
Apply the patched SMA1000 firmware version referenced in SonicWall PSIRT advisory SNWLID-2026-0017 (https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017); the available intelligence did not include an exact fixed version string, so administrators should consult that advisory for the precise upgrade build. Because exploitation requires an authenticated session with high/administrative privileges on the AMC, the most effective compensating controls are to restrict AMC administrative access to trusted management networks, enforce multi-factor authentication for all admin accounts, and audit for unexpected file writes outside normal extraction directories; these measures reduce exposure but do not eliminate the flaw if an attacker already holds admin credentials. Additionally, if archive upload or import features are not operationally required, disabling them removes the vulnerable code path entirely, though this may break legitimate firmware update, backup restore, or configuration import workflows. Monitor vendor channels for updated guidance and validate any interim mitigations against the PSIRT advisory.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in the archive extraction logic of the SonicWall SMA1000 Appliance Management Console (AMC), which processes uploaded archives (e.g., for firmware updates, backups, or configuration imports) without properly sanitizing file paths. An archive entry containing '../' sequences can escape the intended destination directory, a path traversal pattern classed as CWE-22 and commonly known as Zip Slip. The impacted product is identified by CPE cpe:2.3:a:sonicwall:sma1000:*:*:*:*:*:*:*:*, and the CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H confirms a network-reachable, low-complexity attack that requires high privileges (PR:H) and yields high confidentiality, integrity, and availability impact. CISA's SSVC decision framework rated exploitation as 'none', automatable as 'no', and technical impact as 'total', reinforcing that while the potential impact is severe, there is no evidence of automated or active exploitation. The EUVD entry EUVD-2026-94326 lists affected versions as SMA1000 12.5.0-02952 (platform-hotfix) and older, plus 12.4.3-03526 (platform-hotfix) and older.
Know when Sma1000 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
AMC is network-reachable (AV:N) and the archive-upload path is straightforward (AC:L), but it requires administrative privileges (PR:H); successful Zip Slip yields full RCE, so C:H/I:H/A:H.
Primary rating from Vendor (sonicwall).
CVSS VectorVendor: sonicwall
Lifecycle Timeline
3DescriptionCVE.org
A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the intended destination directory using a specially crafted archive, resulting in remote code execution.
Zero Day Initiative Advisories
Executive ViewAI
A high-severity remote code execution flaw in the SonicWall SMA1000 Appliance Management Console could allow an attacker who already holds administrative credentials on the console to write files outside the intended extraction directory and execute code on the appliance. Because the flaw requires pre-existing administrative access, the realistic risk is concentrated in organizations with weak privileged-account governance, shared admin credentials, or already-compromised administrative accounts rather than in opportunistic mass exploitation. Leadership should treat this as a privileged-insider and credential-compromise risk to the remote-access infrastructure that underpins workforce connectivity, and prioritize control hardening over emergency patching since no vendor fix is yet available.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict Appliance Management Console access to a hardened management network or VPN with source-address allow-listing; enforce MFA and least privilege for all AMC administrators and eliminate shared or stale privileged accounts; monitor and alert on administrative logins, archive uploads, and unexpected file writes or process execution on the appliance; segment the SMA1000 from other production assets to limit lateral movement; maintain offline, tested configuration backups and a rebuild procedure that does not depend on the AMC.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Server-side request forgery in the SonicWall SMA1000 Appliance Work Place interface lets remote, unauthenticated attacke
Pre-authentication server-side request forgery in the SonicWall SMA1000 secure-access appliance's Work Place interface l
OS command injection in the SonicWall SMA1000 Appliance Management Console (AMC) allows a remote authenticated administr
Post-authentication OS command execution in the SonicWall SMA1000 Appliance Management Console (AMC) allows a remote att
Stored cross-site scripting in the SonicWall SMA1000 Appliance Management Console (AMC) allows an attacker who already h
Exploit-DB