CVE-2026-3468
Stored XSS in SonicWall Email Security Allows Admin JavaScript Execution
Publication date: 2026-03-31
Last updated on: 2026-04-13
Assigner: SonicWALL, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sonicwall | email_security | to 10.0.35.8405 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a stored Cross-Site Scripting (XSS) issue found in the SonicWall Email Security appliance. It occurs because the system does not properly neutralize user-supplied input when generating web pages. As a result, a remote attacker who is authenticated as an admin user can potentially execute arbitrary JavaScript code within the application.
How can this vulnerability impact me? :
The vulnerability allows a remote authenticated admin user to execute arbitrary JavaScript code, which can lead to unauthorized actions within the application context. This can compromise the integrity and confidentiality of data, potentially allowing attackers to manipulate the application, steal sensitive information, or perform actions on behalf of the admin user.