ZDI-26-770: SonicWall Secure Mobile Access unzip Directory Traversal Remote Code Execution Vulnerability
Published Oct 15, 2026
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of SonicWall Secure Mobile Access. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-102257.
Affected Software
1 affected component
SonicWall Secure Mobile Access
Event History
Oct 15, 2026
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
Who can exploit this issue?
An attacker must authenticate to an affected SonicWall Secure Mobile Access installation before exploiting the vulnerability. The provided information does not identify any specific required privilege level beyond authentication.
2
What is the potential impact after successful exploitation?
A successful attacker can execute arbitrary code on the affected installation remotely. The vulnerability is identified as CVE-2026-102257 and has a CVSS rating of 7.2.