CVE-2026-102257: SonicWall Secure Mobile Access Directory Traversal Remote Code Execution Vulnerability
What It Is – SonicWall Secure Mobile Access contains a flaw in its unzip routine that fails to validate a user‑supplied path, allowing an authenticated attacker to traverse directories and execute arbitrary code.
Exploitability – The vulnerability requires authentication but can be leveraged remotely; a proof‑of‑concept exists. CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Affected Products – SonicWall Secure Mobile Access (all versions prior to the October 2026 patch).
Why It Matters for Trust & Control Assurance
- Highlights the need for continuous monitoring of vendor‑issued patches as part of a defensible vulnerability‑management control.
- Provides audit‑ready evidence that organizations are actively remediating third‑party software risks.
- Demonstrates that control mapping across frameworks (e.g., secure development, change management) can be validated with a single remediation event.
Recommended Actions
- Identify any deployments of SonicWall Secure Mobile Access running a vulnerable version.
- Apply SonicWall’s security update SNWLID‑2026‑0017 immediately.
- Record the patch application in your vulnerability‑management system and map it to the relevant control objective for audit evidence.
Source: Zero Day Initiative advisory