Loading story…
SonicWall disclosed two vulnerabilities in NetExtender Linux Client versions 10.3.5 and earlier that can enable privileged file-path manipulation. Critical CVE-2026-66152 (CVSS 8.8) is a path-traversal issue in OPSWAT tarball handling that could let a remote, unauthenticated attacker—following user interaction—write arbitrary files as root outside the intended extraction directory. CVE-2026-66153 (CVSS 7.0) affects the NEService auto-upgrade process and lets a local low-privileged attacker abuse symbolic links to manipulate temporary-file paths.
SonicWall fixed both flaws in NetExtender Linux Client 10.3.6 and later under advisory SNWLID-2026-0013; no workaround is available. The company reported no evidence of active exploitation, and Windows-based NetExtender clients are unaffected. Organizations should promptly upgrade Linux clients, identify unmanaged Linux endpoints running affected releases, and review privileged archive-extraction and update processes for unsafe path and temporary-file handling.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
SonicWall published advisory SNWLID-2026-0013 disclosing CVE-2026-66152, a CVSS 8.8 path-traversal flaw enabling potential root-level arbitrary file writes, and CVE-2026-66153, a CVSS 7.0 improper link-resolution flaw in NEService auto-upgrade handling. Both affect NetExtender Linux Client 10.3.5 and earlier; SonicWall released fixes in version 10.3.6 and later, reported no evidence of in-the-wild exploitation, and stated that no workaround is available.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
7 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcecirt.gy
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourcepsirt.global.sonicwall.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SonicWall has released patches for eight vulnerabilities affecting its **Global Management System (GMS)** and **Email Security** products, including critical flaws that could enable remote code execution. The most severe issues, tracked as **`CVE-2026-66147`** and **`CVE-2026-66145`**, impact **GMS 9.5.1 and earlier** on both Windows and Linux. SonicWall said the GMS issues were fixed in **version 9.5.2**, while Email Security vulnerabilities were addressed in **version 10.0.36**. `CVE-2026-66147` is described as an unauthenticated command injection flaw in the GMS Dispatcher Service that can allow remote attackers to execute arbitrary code via crafted requests. `CVE-2026-66145` affects the discontinued GMS platform and can allow unauthenticated attackers to achieve remote code execution, read sensitive data, and perform arbitrary file writes through a **Zip Slip** condition. SonicWall said it has **no evidence of in-the-wild exploitation**, but the vulnerabilities carry high technical impact and customers were urged to update promptly.
Aug 12, 2026
SonicWall disclosed active exploitation of two vulnerabilities in **SMA1000-series SSL VPN appliances**: `CVE-2026-83548`, a critical pre-authentication server-side request forgery (SSRF) flaw with a CVSS score of 10.0, and `CVE-2026-83549`, a high-severity post-authentication OS command-injection flaw. The SSRF issue stems from an unintended forward-proxy access path in the Work Place interface and may enable unauthenticated attackers to reach internal resources or potentially execute commands; the command-injection flaw enables authenticated administrators to run arbitrary operating-system commands through the Appliance Management Console. SonicWall has issued hotfix firmware and urged customers to apply it immediately. Organizations operating affected appliances should restrict access to the Work Place and administrative interfaces, monitor appliances for anomalous outbound connections, and review administrator activity and appliance logs for indicators of compromise.
Sep 8, 2026
SonicWall disclosed multiple vulnerabilities affecting **Email Security** and **GMS**, prompting a Canadian Centre for Cyber Security advisory urging administrators to review vendor guidance and apply updates. The affected products include **SonicWall Email Security 10.0.35.8405 and earlier** and **SonicWall GMS 9.5.1 and earlier**. The Cyber Centre said the issues were current as of August 11 and advised organizations to deploy fixes as they become available. For **SonicWall Email Security**, SonicWall identified two authenticated code injection flaws, **`CVE-2026-66149`** and **`CVE-2026-66150`**, each rated **CVSS 7.8**, that could let a user with access to the restricted CLI inject arbitrary OS commands as **root** through the **netmask** and **SNMP** vectors. Separately, **`CVE-2026-66154`** affects **SonicWall GMS on Linux** and stems from **insufficient certificate validation** in a privileged communication workflow, creating a man-in-the-middle path to unauthorized changes under controlled network conditions. SonicWall said it had **no evidence of in-the-wild exploitation** for the Email Security flaws and directed customers to upgrade to fixed releases.
Aug 14, 2026