Loading story…
SonicWall disclosed multiple vulnerabilities affecting Email Security and GMS, prompting a Canadian Centre for Cyber Security advisory urging administrators to review vendor guidance and apply updates. The affected products include SonicWall Email Security 10.0.35.8405 and earlier and SonicWall GMS 9.5.1 and earlier. The Cyber Centre said the issues were current as of August 11 and advised organizations to deploy fixes as they become available.
For SonicWall Email Security, SonicWall identified two authenticated code injection flaws, CVE-2026-66149 and CVE-2026-66150, each rated CVSS 7.8, that could let a user with access to the restricted CLI inject arbitrary OS commands as root through the netmask and SNMP vectors. Separately, CVE-2026-66154 affects SonicWall GMS on Linux and stems from insufficient certificate validation in a privileged communication workflow, creating a man-in-the-middle path to unauthorized changes under controlled network conditions. SonicWall said it had no evidence of in-the-wild exploitation for the Email Security flaws and directed customers to upgrade to fixed releases.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published alert AV26-809 stating that, as of August 11, 2026, SonicWall Email Security 10.0.35.8405 and earlier and SonicWall GMS 9.5.1 and earlier are affected by vulnerabilities. The notice advised users and administrators to review the linked advisories and apply updates as they become available.
A CVE record for CVE-2026-66154 was received and modified on August 11, 2026, describing an insufficient certificate validation vulnerability affecting SonicWall GMS 9.5.1 and earlier on Linux. The entry references SonicWall advisory SNWLID-2026-0011 and notes the flaw could permit unauthorized changes under man-in-the-middle conditions.
SonicWall published advisory SNWLID-2026-0012 disclosing CVE-2026-66149 and CVE-2026-66150 in SonicWall Email Security. The vulnerabilities allow an authenticated attacker with restricted CLI access to inject arbitrary OS commands as root via the netmask and SNMP vectors, and SonicWall said there was no evidence of in-the-wild exploitation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcecirt.gy
Open sourcecvefeed.io
Open sourcepsirt.global.sonicwall.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SonicWall has released patches for eight vulnerabilities affecting its **Global Management System (GMS)** and **Email Security** products, including critical flaws that could enable remote code execution. The most severe issues, tracked as **`CVE-2026-66147`** and **`CVE-2026-66145`**, impact **GMS 9.5.1 and earlier** on both Windows and Linux. SonicWall said the GMS issues were fixed in **version 9.5.2**, while Email Security vulnerabilities were addressed in **version 10.0.36**. `CVE-2026-66147` is described as an unauthenticated command injection flaw in the GMS Dispatcher Service that can allow remote attackers to execute arbitrary code via crafted requests. `CVE-2026-66145` affects the discontinued GMS platform and can allow unauthenticated attackers to achieve remote code execution, read sensitive data, and perform arbitrary file writes through a **Zip Slip** condition. SonicWall said it has **no evidence of in-the-wild exploitation**, but the vulnerabilities carry high technical impact and customers were urged to update promptly.
Aug 12, 2026
SonicWall has patched two vulnerabilities that are being actively exploited against **SMA 1000 Series** appliances, affecting models including **6210, 7210, and 8200v**. The flaws, tracked as **`CVE-2026-15409`** and **`CVE-2026-15410`**, impact multiple **12.4.3** and **12.5.0** platform-hotfix releases. SonicWall described `CVE-2026-15409` as a **critical unauthenticated SSRF** issue in the Appliance Work Place interface and `CVE-2026-15410` as a **high-severity code injection** flaw in the Appliance Management Console that can allow an authenticated administrator to execute arbitrary operating system commands. SonicWall said the vulnerabilities have been exploited together in the wild and released hotfixes to address them. Government and vendor advisories urged organizations to update immediately and investigate appliances for signs of compromise, warning that patching alone may not be sufficient if an appliance has already been breached. SonicWall recommended reviewing logs, re-imaging or re-deploying affected systems where indicators are found, changing user and administrator passwords, and resetting TOTP tokens. The **Canadian Centre for Cyber Security** highlighted the advisory, and **CISA** added both vulnerabilities to its **Known Exploited Vulnerabilities** catalog the same day, underscoring the urgency for defenders to remediate exposed SMA1000 deployments.
Aug 25, 2026
SonicWall has released security advisories addressing multiple vulnerabilities affecting its Email Security appliances and Gen7/Gen8 hardware and virtual firewalls. The most critical issue is a stack-based buffer overflow vulnerability in the SonicOS SSLVPN service, tracked as CVE-2025-40601, which allows remote unauthenticated attackers to cause a denial-of-service condition and crash impacted firewalls. SonicWall has stated that there is no evidence of active exploitation or public proof-of-concept code for this vulnerability, but urges immediate patching. The affected products include various models of Gen7 and Gen8 firewalls, with fixed versions now available. Gen6 firewalls and SMA SSL VPN products are not affected. In addition to the firewall vulnerability, SonicWall also patched two vulnerabilities in its Email Security appliances, which could enable remote attackers to compromise these systems. Administrators unable to immediately apply the updates are advised to disable the SSLVPN service or restrict access to trusted sources as a temporary mitigation. The Canadian Centre for Cyber Security and SonicWall both recommend that users and administrators review the advisories and apply the necessary updates to protect their environments from potential exploitation.
Jun 29, 2026