SonicWall Secure Mobile Access Vulnerable to Remote Code Execution via Directory Traversal
A critical directory traversal vulnerability in SonicWall Secure Mobile Access (SMA) allows authenticated attackers to achieve remote code execution, rated CVSS 7.2.
A significant security vulnerability has been identified in SonicWall's Secure Mobile Access (SMA) product, enabling authenticated remote attackers to execute arbitrary code on affected systems. The flaw, officially designated as CVE-2026-102257, leverages a directory traversal technique within the product's unzip functionality.
The vulnerability stems from an insufficient validation of user-supplied path information before it is utilized in file operations. This oversight allows an attacker, who has already gained authenticated access to the SMA device, to manipulate file paths and potentially overwrite critical system files or plant malicious code. Successful exploitation could lead to the attacker gaining root-level privileges on the compromised appliance.
The Zero Day Initiative (ZDI), which disclosed the vulnerability, assigned it a CVSS score of 7.2, classifying it as high severity. While authentication is a prerequisite for exploitation, the potential for remote code execution makes this a critical concern for organizations relying on SonicWall SMA for secure remote access.
SonicWall has acknowledged the vulnerability and has released security updates to address the issue. The company's Product Security Incident Response Team (PSIRT) has provided details on the fix, urging customers to apply the available patches promptly to mitigate the risk. The advisory for this vulnerability is referenced as SNWLID-2026-0017.
The disclosure timeline indicates that the vulnerability was initially reported to SonicWall on July 21, 2026. Following coordinated efforts between ZDI and SonicWall, a public advisory was released on October 15, 2026, coinciding with the availability of the patch. This coordinated disclosure aims to give customers sufficient time to update their systems before the vulnerability becomes widely known and potentially exploited.
This discovery highlights the ongoing challenges in securing remote access solutions, which often present attractive targets for attackers due to the sensitive data and network access they provide. The requirement for authentication does not diminish the severity, as compromised credentials or insider threats could be leveraged to exploit such flaws.
Organizations using SonicWall SMA are strongly advised to consult the vendor's security advisories and apply all recommended patches and updates immediately. Regular security audits and robust access control measures remain crucial to defending against sophisticated threats that target network infrastructure components.