SonicWall GMS Virtual Appliance interface Command Injection Local Privilege Escalation Vulnerability (CVE-2026-66148)

CVE number – CVE-2026-66148

This vulnerability allows local attackers to escalate privileges on affected installations of SonicWall GMS Virtual Appliance.

An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the handling of the interface command.

The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call.

An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root.

SonicWall has issued an update to correct this vulnerability.

Blogger at www.systemtek.co.uk