ZDI-26-770: SonicWall Secure Mobile Access unzip Directory Traversal Remote Code Execution Vulnerability
ZDI discloses authenticated remote code execution in SonicWall Secure Mobile Access via unzip traversal, CVE-2026-102257.
Trend Micro's Zero Day Initiative published ZDI-26-770 for CVE-2026-102257 in SonicWall Secure Mobile Access. An authenticated remote attacker can use an unzip directory traversal flaw to execute arbitrary code. ZDI assigned a CVSS score of 7.2. The advisory does not report exploitation in the wild.
- CVE-2026-102257 allows authenticated remote code execution.
- Flaw is an unzip directory traversal in SonicWall Secure Mobile Access.
- ZDI rates the issue CVSS 7.2; exploitation is not reported.
- CVEs
- CVE-2026-102257
- Vendors
- SonicWall
- Products
- SonicWall Secure Mobile Access
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102257 | Zip Slip RCE in SonicWall SMA 1000 AMC | 7.2 | — |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of SonicWall Secure Mobile Access. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.