SonicWall security advisories, August 2026

Every SonicWall security advisory published in August 2026, from SonicWall PSIRT ([email protected] CNA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 15
Critical: 1
High: 2
In CISA KEV: 0
CVEs: 12

SonicWall advisories published in August 2026

Aug 25, 2026
High [CVE-2026-66152 +1] NetExtender: Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write a…
High8.8
Aug 25, 2026
Advisory [CVE-2026-66153] The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths
Unrated
Aug 25, 2026
Advisory [CVE-2026-66152] Path traversal vulnerability in OPSWAT tarball in the SonicWall NetExtender Linux client allows an attacker to write arbitrary file as root
Unrated
Aug 11, 2026
Critical [CVE-2026-66145 +5] GMS: unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which…
Critical9.4
Aug 11, 2026
High [CVE-2026-66149 +1] Email Security: Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an aut…
High7.8
Aug 11, 2026
Advisory [CVE-2026-66150] Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via SNMP
Unrated
Aug 11, 2026
Advisory [CVE-2026-66149] Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask
Unrated
Aug 11, 2026
Advisory [CVE-2026-18634] insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions
Unrated
Aug 11, 2026
Advisory [CVE-2026-66154] insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions which, under a successful MitM attack and controlled network conditions, could permit unauthorized changes
Unrated
Aug 11, 2026
Advisory [CVE-2026-66148] authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier versions which allows low-privileged local user to execute system commands with root privileges
Unrated
Aug 11, 2026
Advisory [CVE-2026-66147] unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests
Unrated
Aug 11, 2026
Advisory [CVE-2026-66146] Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote attacker to execute javascript script in a user's browser
Unrated
Aug 11, 2026
Advisory [CVE-2026-66145] unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip
Unrated
Aug 7, 2026
Medium [CVE-2026-66151] Global VPN Client: SonicWall Global VPN Client version 4.10.8.1108 and earlier is vulnerable to an out-of-bounds kernel memory read in the SWIPsec…
Medium5.5
Aug 5, 2026
Medium [CVE-2026-0516] SonicOS: improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipu…
Medium6.5

Get an email when SonicWall publishes the next one.

See SonicWall's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about SonicWall

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.