Key points
- The flaw, CVE-2026-102257, is rated CVSS 7.2 by the Zero Day Initiative.
- Attackers must authenticate to exploit the unzip method vulnerability.
- SonicWall has released an update to correct the issue.
SonicWall has released an update for Secure Mobile Access to address a flaw that allows remote attackers to execute arbitrary code on affected systems. The Zero Day Initiative reports that the vulnerability, identified as CVE-2026-102257, carries a CVSS score of 7.2. Successful exploitation requires the attacker to first authenticate to the application, but the resulting impact is significant because the code runs in the context of root.
In plain English
The vulnerability exists within the way the application handles file unzipping operations. According to the Zero Day Initiative advisory, the system fails to properly validate user-supplied paths before using them in file operations. This lack of validation allows an attacker to traverse directories and execute arbitrary code. Because the exploit leverages the unzip method, an attacker can manipulate the path to place malicious files in sensitive locations, leading to remote code execution with root privileges.
The background
The Zero Day Initiative reported this vulnerability to SonicWall on July 21, 2026. The coordinated public release of the advisory occurred on October 15, 2026. This incident involves a specific flaw in SonicWall's Secure Mobile Access product, distinct from other recent software vulnerabilities reported in the industry.
What changes now
SonicWall has issued an update to correct this vulnerability. The vendor directs users to its PSIRT page for specific details. Security teams should verify their current version of Secure Mobile Access against the vendor’s advisory to determine if their installation is affected. Applying the update will patch the directory traversal flaw in the unzip method, restoring proper path validation and preventing unauthorized code execution.
Who needs to act first
Teams should prioritize updating systems that are exposed to the internet or accessible via VPN, as these face the highest risk of remote exploitation. Before applying the patch, administrators should back up their current configuration to ensure a quick rollback if issues arise. It is also wise to test the update in a non-production environment first to verify stability. If immediate patching is not possible, restrict access to the application interface to trusted networks only, reducing the attack surface while a fix is prepared.
What to do and how to stay safe: SonicWall
- Check your SonicWall Secure Mobile Access version against the vendor's advisory to confirm if you are vulnerable.
- Apply the latest vendor update as soon as possible to patch the directory traversal flaw.
- Monitor logs for unusual file operations or unauthorized access attempts following authentication.
- Review access controls to ensure only necessary users have authenticated access to the application.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is this vulnerability being exploited in the wild?
The source material does not state whether this flaw is currently being exploited in the wild.
Do attackers need a password to exploit this bug?
Yes, authentication is required to exploit this vulnerability according to the Zero Day Initiative.
What is the severity rating of this flaw?
The Zero Day Initiative assigned a CVSS rating of 7.2 to this vulnerability.
