Code Injection Vulnerability in SonicWall Email Security Appliance
CVE-2026-66149

7.8HIGH

Key Information:

Vendor

Sonicwall
Status
Email Security
Vendor
CVE Published:
11 August 2026

What is CVE-2026-66149?

An improper control of code generation vulnerability has been identified in the SonicWall Email Security appliance. This weakness allows an authenticated user with access to the restricted command-line interface (CLI) to inject arbitrary operating system commands. The injected commands execute with root privileges, potentially leading to unauthorized configuration changes or access to sensitive data.

Affected Version(s)

Email Security Linux 10.0.35.8405 and earlier versions

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-202...
vendor-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.