ZDI-26-530: SonicWall Email Security snmp Command Injection Local Privilege Escalation Vulnerability

CVE-2026-66150 is a code injection flaw (CWE-94) in the SonicWall Email Security appliance in which the restricted CLI improperly controls command generation for SNMP-related functions. An attacker who has already authenticated to the restricted CLI with low-level privileges can inject arbitrary operating system commands through the SNMP pathway, and those commands execute with root privileges. Successful exploitation therefore yields full compromise of the appliance — read, write, and availability impact as root — making it effectively a local privilege escalation from a restricted administrative account to total system control. Any organization running an on-premises SonicWall Email Security appliance is potentially exposed, though exploitation requires the attacker to first obtain authenticated CLI access, such as via a compromised or misused admin account. There is currently no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns a low 0.2% probability of exploitation within 30 days.

Do: Track the SonicWall PSIRT advisory (CVE-2026-66150) and apply the patched firmware as soon as a fixed version is published. In the interim, limit restricted CLI access to trusted administrators, audit which accounts have CLI access for signs of compromise, and disable or restrict the SNMP service on the appliance if it is not required. Because exploitation requires prior authenticated CLI access, prioritize remediation on appliances where admin credentials may have been shared or exposed.