Loading story…
SonicWall has released patches for eight vulnerabilities affecting its Global Management System (GMS) and Email Security products, including critical flaws that could enable remote code execution. The most severe issues, tracked as CVE-2026-66147 and CVE-2026-66145, impact GMS 9.5.1 and earlier on both Windows and Linux. SonicWall said the GMS issues were fixed in version 9.5.2, while Email Security vulnerabilities were addressed in version 10.0.36.
CVE-2026-66147 is described as an unauthenticated command injection flaw in the GMS Dispatcher Service that can allow remote attackers to execute arbitrary code via crafted requests. CVE-2026-66145 affects the discontinued GMS platform and can allow unauthenticated attackers to achieve remote code execution, read sensitive data, and perform arbitrary file writes through a Zip Slip condition. SonicWall said it has no evidence of in-the-wild exploitation, but the vulnerabilities carry high technical impact and customers were urged to update promptly.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
As part of its August 12, 2026 patch announcement, SonicWall stated it had no evidence that the disclosed vulnerabilities had been exploited in the wild and urged customers to apply updates promptly.
On August 12, 2026, SonicWall announced patches for eight vulnerabilities across its GMS and Email Security products. The company fixed six GMS issues, including critical flaws CVE-2026-66145 and CVE-2026-66147 in GMS version 9.5.2, and patched Email Security command injection bugs CVE-2026-66149 and CVE-2026-66150 in version 10.0.36.
On August 11, 2026, the CVE record for CVE-2026-66147 was newly received by PSIRT@sonicwall.com and updated with affected-product details, description, CVSS data, and a SonicWall PSIRT advisory reference. The issue is an unauthenticated command injection flaw in the GMS Dispatcher Service that can lead to remote code execution on SonicWall GMS 9.5.1 and earlier for Windows and Linux.
On August 11, 2026, the CVE record for CVE-2026-66145 was newly received by PSIRT@sonicwall.com and updated with affected-product details, vulnerability description, CVSS data, and a SonicWall PSIRT advisory reference. The flaw affects SonicWall GMS 9.5.1 and earlier on Windows and Linux and can enable unauthenticated remote code execution, sensitive-data access, and arbitrary file write via Zip Slip.
SecurityWeek reported that SonicWall retired its Global Management System (GMS) platform in October 2025. The later-disclosed GMS vulnerabilities affected this discontinued product line.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourceacn.gov.it
Open sourcesecurityweek.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcepsirt.global.sonicwall.com
Open sourcepsirt.global.sonicwall.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SonicWall disclosed multiple vulnerabilities affecting **Email Security** and **GMS**, prompting a Canadian Centre for Cyber Security advisory urging administrators to review vendor guidance and apply updates. The affected products include **SonicWall Email Security 10.0.35.8405 and earlier** and **SonicWall GMS 9.5.1 and earlier**. The Cyber Centre said the issues were current as of August 11 and advised organizations to deploy fixes as they become available. For **SonicWall Email Security**, SonicWall identified two authenticated code injection flaws, **`CVE-2026-66149`** and **`CVE-2026-66150`**, each rated **CVSS 7.8**, that could let a user with access to the restricted CLI inject arbitrary OS commands as **root** through the **netmask** and **SNMP** vectors. Separately, **`CVE-2026-66154`** affects **SonicWall GMS on Linux** and stems from **insufficient certificate validation** in a privileged communication workflow, creating a man-in-the-middle path to unauthorized changes under controlled network conditions. SonicWall said it had **no evidence of in-the-wild exploitation** for the Email Security flaws and directed customers to upgrade to fixed releases.
Aug 14, 2026
SonicWall disclosed multiple vulnerabilities in **SonicOS** affecting Generation 6, 7, and 8 hardware and virtual firewall products, including flaws that could let attackers bypass access controls, reach restricted services, or trigger denial of service by crashing firewalls. The issues, identified by CrowdStrike’s Advanced Research Team and tracked as `CVE-2026-0204`, `CVE-2026-0205`, and `CVE-2026-0206`, carry CVSS scores of **8.0**, **6.8**, and **4.9** respectively, and were also reflected in advisory **dCERT 2026-1294**. SonicWall released fixed firmware versions and urged administrators to apply updates immediately. Where patching cannot be completed at once, the company advised disabling **HTTP/HTTPS management** and **SSLVPN** on all interfaces and restricting management access to **SSH**. SonicWall also warned Generation 6 customers not to downgrade from patched firmware, saying a rollback will delete LDAP users and reset MFA configurations.
Jun 29, 2026
SonicWall has patched two vulnerabilities that are being actively exploited against **SMA 1000 Series** appliances, affecting models including **6210, 7210, and 8200v**. The flaws, tracked as **`CVE-2026-15409`** and **`CVE-2026-15410`**, impact multiple **12.4.3** and **12.5.0** platform-hotfix releases. SonicWall described `CVE-2026-15409` as a **critical unauthenticated SSRF** issue in the Appliance Work Place interface and `CVE-2026-15410` as a **high-severity code injection** flaw in the Appliance Management Console that can allow an authenticated administrator to execute arbitrary operating system commands. SonicWall said the vulnerabilities have been exploited together in the wild and released hotfixes to address them. Government and vendor advisories urged organizations to update immediately and investigate appliances for signs of compromise, warning that patching alone may not be sufficient if an appliance has already been breached. SonicWall recommended reviewing logs, re-imaging or re-deploying affected systems where indicators are found, changing user and administrator passwords, and resetting TOTP tokens. The **Canadian Centre for Cyber Security** highlighted the advisory, and **CISA** added both vulnerabilities to its **Known Exploited Vulnerabilities** catalog the same day, underscoring the urgency for defenders to remediate exposed SMA1000 deployments.
Aug 25, 2026