ZDI-26-530: SonicWall Email Security snmp Command Injection Local Privilege Escalation Vulnerability
ZDI advisory discloses SonicWall Email Security snmp command injection local privilege escalation (CVE-2026-66150, CVSS 7.8).
ZDI advisory ZDI-26-530 describes a command injection vulnerability in the snmp component of SonicWall Email Security, tracked as CVE-2026-66150 with a CVSS score of 7.8. Local attackers who can already execute low-privileged code on the target can escalate privileges on affected installations.
- Command injection via snmp in SonicWall Email Security
- CVE-2026-66150, CVSS 7.8, local privilege escalation
- Requires existing low-privileged code execution
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-66150 | Authenticated CLI command injection to root in SonicWall Email Security via SNMP | 7.8 | <1% |
From the original article
This vulnerability allows local attackers to escalate privileges on affected installations of SonicWall Email Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.