Loading story…
SonicWall disclosed multiple vulnerabilities in Network Security Manager (NSM) On-Prem affecting version 4.3.0 and earlier. The affected deployments include VMware, Hyper-V, Microsoft Azure, and KVM environments under advisory SNWLID-2026-0015.
The Canadian Centre for Cyber Security and Guyana National CIRT issued follow-on notices urging administrators to review SonicWall’s advisory and apply applicable updates as they become available. Public notices did not provide CVE identifiers, severity ratings, vulnerability details, exploitation status, or specific fixed-version information.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued advisory AV26-884 regarding the SonicWall NSM On-Prem vulnerabilities and advised affected users and administrators to review SonicWall's advisory and apply necessary updates.
SonicWall published advisory SNWLID-2026-0015 covering multiple vulnerabilities in Network Security Manager (NSM) On-Prem version 4.3.0 and earlier, including VMware, Hyper-V, Azure, and KVM deployments. The advisory information provided did not identify CVEs, vulnerability types, severity, or exploitation status.
SonicWall identified CVE-2026-78327 (SuperAdmin command injection), CVE-2026-78328 (Admin-to-SuperAdmin privilege escalation), and CVE-2026-81939 (Zip Slip path traversal) in NSM On-Prem. It advised upgrades to a fixed release, stated NSM SaaS is unaffected, and reported no evidence of exploitation in the wild.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecirt.gy
Open sourcepsirt.global.sonicwall.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SonicWall disclosed multiple vulnerabilities affecting **Email Security** and **GMS**, prompting a Canadian Centre for Cyber Security advisory urging administrators to review vendor guidance and apply updates. The affected products include **SonicWall Email Security 10.0.35.8405 and earlier** and **SonicWall GMS 9.5.1 and earlier**. The Cyber Centre said the issues were current as of August 11 and advised organizations to deploy fixes as they become available. For **SonicWall Email Security**, SonicWall identified two authenticated code injection flaws, **`CVE-2026-66149`** and **`CVE-2026-66150`**, each rated **CVSS 7.8**, that could let a user with access to the restricted CLI inject arbitrary OS commands as **root** through the **netmask** and **SNMP** vectors. Separately, **`CVE-2026-66154`** affects **SonicWall GMS on Linux** and stems from **insufficient certificate validation** in a privileged communication workflow, creating a man-in-the-middle path to unauthorized changes under controlled network conditions. SonicWall said it had **no evidence of in-the-wild exploitation** for the Email Security flaws and directed customers to upgrade to fixed releases.
Aug 14, 2026
SonicWall has patched two vulnerabilities that are being actively exploited against **SMA 1000 Series** appliances, affecting models including **6210, 7210, and 8200v**. The flaws, tracked as **`CVE-2026-15409`** and **`CVE-2026-15410`**, impact multiple **12.4.3** and **12.5.0** platform-hotfix releases. SonicWall described `CVE-2026-15409` as a **critical unauthenticated SSRF** issue in the Appliance Work Place interface and `CVE-2026-15410` as a **high-severity code injection** flaw in the Appliance Management Console that can allow an authenticated administrator to execute arbitrary operating system commands. SonicWall said the vulnerabilities have been exploited together in the wild and released hotfixes to address them. Government and vendor advisories urged organizations to update immediately and investigate appliances for signs of compromise, warning that patching alone may not be sufficient if an appliance has already been breached. SonicWall recommended reviewing logs, re-imaging or re-deploying affected systems where indicators are found, changing user and administrator passwords, and resetting TOTP tokens. The **Canadian Centre for Cyber Security** highlighted the advisory, and **CISA** added both vulnerabilities to its **Known Exploited Vulnerabilities** catalog the same day, underscoring the urgency for defenders to remediate exposed SMA1000 deployments.
Aug 25, 2026
SonicWall disclosed multiple vulnerabilities in **SonicOS** affecting Generation 6, 7, and 8 hardware and virtual firewall products, including flaws that could let attackers bypass access controls, reach restricted services, or trigger denial of service by crashing firewalls. The issues, identified by CrowdStrike’s Advanced Research Team and tracked as `CVE-2026-0204`, `CVE-2026-0205`, and `CVE-2026-0206`, carry CVSS scores of **8.0**, **6.8**, and **4.9** respectively, and were also reflected in advisory **dCERT 2026-1294**. SonicWall released fixed firmware versions and urged administrators to apply updates immediately. Where patching cannot be completed at once, the company advised disabling **HTTP/HTTPS management** and **SSLVPN** on all interfaces and restricting management access to **SSH**. SonicWall also warned Generation 6 customers not to downgrade from patched firmware, saying a rollback will delete LDAP users and reset MFA configurations.
Jun 29, 2026