SonicWall Email Security Vulnerabilities & Security Advisories
7 advisories tracked · SonicWall PSIRT ([email protected] CNA) via NVD · 3 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published SonicWall advisory that VulniPulse classified as Email Security, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 1 high, 1 medium.
Android app · Google Play
Monitor SonicWall CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Source
SonicWall PSIRT ([email protected] CNA) via NVD
SonicWall is its own CVE Numbering Authority. Its PSIRT portal (psirt.global.sonicwall.com) is a reCAPTCHA-gated JavaScript app with no stable public feed, so VulniPulse ingests SonicWall's CVEs from the NVD CNA feed ([email protected]), grouped by the official SNWLID advisory, with affected products and versions from each description and a link back to the SNWLID advisory. Covers SonicOS firewalls (Gen6/Gen7 TZ/NSa/NSsp/NSv), Secure Mobile Access (SMA 100/1000), SSL-VPN, NetExtender, Email Security and GMS/Analytics — SonicWall SSL-VPN is a frequent ransomware entry point.
Latest SonicWall Email Security advisories
High [CVE-2026-66149 +1] Email Security: Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an aut…
Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask.
Advisory [CVE-2026-66150] Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via SNMP
Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via SNMP.
Advisory [CVE-2026-66149] Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask
Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask.
Medium [CVE-2026-3468 +2] Email Security: stored Cross-Site Scripting (XSS) vulnerability has been identified in the SonicWall Email Security appliance due to improper…
A stored Cross-Site Scripting (XSS) vulnerability has been identified in the SonicWall Email Security appliance due to improper neutralization of user-supplied input during web page generation, allowing a remote authenticated attacker as admin user to potentially execute arbitrary JavaScript code.
Advisory [CVE-2021-20023] SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.
Advisory [CVE-2021-20022] SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.
Advisory [CVE-2021-20021] vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.