## Summary
CVE-2026-66149 is a code injection vulnerability in SonicWall Email Security appliances that allows an authenticated attacker with access to the SonicWall Email Security restricted CLI to inject arbitrary OS commands.
The injected commands execute as root via netmask, resulting in full compromise of confidentiality, integrity, and availability.
## Technical Details
- Vulnerability type: Improper Control of Generation of Code (CWE-94), described as Code Injection.
- Attack vector: LOCAL with PR:L (requires local/adjacent access as an authenticated user).
- Preconditions (from NVD description):
- Attacker is authenticated.
- Attacker has access to the SonicWall Email Security restricted CLI.
- Execution context:
- Arbitrary OS commands can be injected and executed as root.
- The injection path is described as occurring via netmask.
## Affected
- SonicWall Email Security appliance (specific affected versions are not provided in the supplied material).
## Impact
- Confidentiality impact: C:H (high)
- Integrity impact: I:H (high)
- Availability impact: A:H (high)
- Overall severity: high with CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
## Mitigation
1. Restrict and tightly control access to the SonicWall Email Security restricted CLI so only trusted administrators can use it.
2. Review and harden any workflows that allow netmask-related inputs/commands through the restricted CLI.
3. Apply vendor patches or updates for CVE-2026-66149 as soon as they are available (no patch details were provided in the supplied material).
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-94