Security Update Advisory for SonicWall Products

Overview

Several vulnerabilities have been discovered in SonicWall products, and security updates have been released. The affected products are SonicWall GMS (Virtual Appliance, Windows) and SonicWall Email Security.

Affected Products and Versions

• SonicWall GMS (Virtual Appliance, Windows): 9.5.1 And earlier.
• SonicWall Email Security: 10.0.35.8405 And earlier.

Resolved Vulnerabilities

• Unauthenticated remote code execution vulnerability in SonicWall GMS (CVE-2026-66145).
• Multiple cross-site scripting (XSS) vulnerabilities in SonicWall GMS (CVE-2026-66146).
• Unauthenticated command injection vulnerability in SonicWall GMS Dispatcher Service (CVE-2026-66147).
• Local privilege escalation vulnerability caused by command injection in SonicWall GMS CLI (CVE-2026-66148).
• A code injection vulnerability in SonicWall Email Security via the netmask (CVE-2026-66149).
• A code injection vulnerability in SonicWall Email Security via SNMP (CVE-2026-66150).
• User compromise vulnerability in SonicWall GMS caused through a man-in-the-middle (MiTM) attack (CVE-2026-66154).
• A local privilege escalation vulnerability (CVE-2026-18634) in SonicWall GMS caused by deserialization of untrusted data.

Recommended Actions

Vulnerability Patches are available in the latest updates. SonicWall GMS must be updated to version 9.5.2 Or later, and SonicWall Email Security must be updated to version 10.0.36 Or later.