Zero Day MonitorZDM

← Back to list

7.8

CVE-2026-102256PATCHED

sonicwall · sma1000

CVE-2026-102256: Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi

Description

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.

Affected Products

Vendor	Product	Versions
sonicwall	sma1000	12.4.3-03526 (platform-hotfix) and older versions, 12.5.0-02952 (platform-hotfix) and older versions

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017(vendor-advisory)

Related News (6 articles)

Tier D

Heise Security5d ago

SonicWall SMA1000: Lücke mit Höchstwertung öffnet interne Funktionen

→ No new info (linked only)

Tier D

CSO Online5d ago

SonicWall’s latest critical flaw indicates a security pattern, not another one-off bug

→ No new info (linked only)

Tier D

The Hacker News5d ago

SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances

→ No new info (linked only)

Tier C

VulDB5d ago

CVE-2026-102256 | SonicWall SMA1000 os command injection

→ No new info (linked only)

Tier B

BSI Advisories5d ago

[NEU] [hoch] SonicWall SMA1000: Mehrere Schwachstellen

→ No new info (linked only)

Tier B

CERT-FR6d ago

Multiples vulnérabilités dans Sonicwall Secure Mobile Access (07 octobre 2026)

→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.17.8 HIGH

VectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA KEV❌ No

Actively exploited❌ No

Patch available

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017

CWECWE-78

PublishedOct 7, 2026

Trending Score33

Source articles6

Independent6

Info Completeness0/14

Missing: cve_id, title, description, vendor, product, versions, cvss, epss, cwe, kev, exploit, patch, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

CRITICALCVE-2026-102255

CVE-2026-102255: A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended altern

CRITICALCVE-2026-83548EXPKEV

CVE-2026-83548: A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended altern

HIGHCVE-2026-83549EXPKEV

CVE-2026-83549: Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi

HIGHCVE-2026-102257

CVE-2026-102257: A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extrac

MEDIUMCVE-2026-102258

CVE-2026-102258: Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Managem

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Oct 7, 2026

Discovered by ZDM

Oct 7, 2026

Patch Available

Oct 8, 2026