← Vulnerability feed

Vulnerability record · CVE-2026-3468 · published 31 March 2026

CVE-2026-3468: Sonicwall email security cross-site scripting vulnerability

Sonicwall · Email Security

A stored Cross-Site Scripting (XSS) vulnerability has been identified in the SonicWall Email Security appliance due to improper neutralization of user-supplied input during web page generation, allowing a remote authenticated attacker as admin user to potentially execute arbitrary JavaScript code.

4.8 CVSS 3.1 Medium EPSS 0.29% · top 80.3% CWE-79 · Cross-site scripting
4.8CVSS 3.1 base score
0.29%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
24 Jul 2026Last modified by NVD

Description

A stored Cross-Site Scripting (XSS) vulnerability has been identified in the SonicWall Email Security appliance due to improper neutralization of user-supplied input during web page generation, allowing a remote authenticated attacker as admin user to potentially execute arbitrary JavaScript code.

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0002 Vendor Advisory

Track CVE-2026-3468 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2021-44228Apache Log4j2 JNDI lookup remote code executionApache Log4j2 versions 2.0-beta9 through 2.15.0 (excluding 2.12.2, 2.12.3, and 2.3.1) do not protect against attacker-controlled LDAP and other JNDI …KEVEPSS 100%analysed9.8CVE-2021-20021SonicWall Email Security improper privilege management allows admin account creationSonicWall Email Security 10.0.9.x contains an improper privilege management flaw that lets an attacker create an administrative account by sending a …KEVEPSS 89%analysed9.0CVE-2021-45046Apache Log4j 2.15.0 Incomplete Fix Allows JNDI Lookup InjectionThe fix for CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. When a non-default Pattern Layout uses a Cont…KEVEPSS 100%analysed7.2CVE-2021-20022SonicWall Email Security post-auth unrestricted file uploadSonicWall Email Security 10.0.9.x allows an authenticated attacker to upload an arbitrary file to the remote host (CWE-434). Because the upload is un…KEVEPSS 17%analysed4.9CVE-2021-20023SonicWall Email Security path traversal allows authenticated file readSonicWall Email Security 10.0.9.x contains a path traversal flaw (CWE-22) that lets an authenticated attacker read arbitrary files on the remote host…KEVEPSS 52%analysed7.4CVE-2021-3450Openssl improper certificate validation vulnerabilityThe X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Sta…EPSS 18%5.9CVE-2021-45105Apache Log4j2 uncontrolled recursion in self-referential lookups causes DoSApache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) fail to protect against uncontrolled recursion from self-referential lo…EPSS 100%analysed5.3CVE-2023-0655Sonicwall email security error message information leak vulnerabilitySonicWall Email Security contains a vulnerability that could permit a remote unauthenticated attacker access to an error page that includes sensitive…EPSS 0.72%

Source: NIST National Vulnerability Database (record CVE-2026-3468), CISA KEV, FIRST EPSS (scores of 2026-10-09). This page is refreshed as NVD updates the record.