Multiple Vulnerabilities in SonicWall GMS and Email Security

Affected Environment
SonicWall Global Management System virtual appliance and Windows, plus Email Security appliance and virtual deployments.

Threat Overview
Eight vulnerabilities include unauthenticated remote code execution, command injection, privilege escalation, and certificate weaknesses.

Exposure Timeline
Disclosed 12 August 2026; no active exploitation reported by SonicWall at time of publication.

Attack Surface
Exposed GMS management services and Email Security netmask and SNMP configuration parameters accepting unsanitized input.

Technical Root Cause
Zip Slip path traversal, insecure deserialization, insufficient certificate validation, and unsanitized command parameters.

Exploitation Pathway
Remote attacker exploits public facing management service to execute code, escalate privileges, or intercept traffic via MitM.