Vulnerability research by our security team.

On July 7, 2026, we discovered this vulnerability and submitted our report to the Zero Day Initiative (ZDI). After 105 days, we received a response declining the acquisition because the vulnerability no longer reproduced on the current build. Meanwhile, another company had reported the same vulnerability to SonicWall.

This experience has seriously undermined our confidence in ZDI. This is not about money, but about respecting researchers' time and contributions. Researchers deserve timely reviews, transparent communication, and proper recognition for their work. Here's the description and video of the vulnerability.

An authenticated administrator of the SonicWALL Network Security Manager can exploit an OS command injection vulnerability to execute arbitrary operating system commands with root privileges. Although the product intentionally restricts access to the underlying operating system, successful exploitation completely bypasses these security restrictions and provides unrestricted root access to the appliance. This results in a complete compromise of the underlying operating system. update to last version: sw_nsm_-vmware.4.4.0-0007-R350.

DigitalCanion SA identified a high-severity vulnerability in a WatchGuard product, rated CVSS 8.5 (High). Referenced as DGI-SWISS-00037, it has been reported to the vendor and has already been assigned the identifier CVE-2026-108152 (reserved record); coordinated disclosure is under way. Technical details will be published once the embargo period ends; this page will be updated upon publication.

DigitalCanion SA has discovered a path traversal vulnerability on Koozali SME Server v11.0.0-267.el8 in the View Logs functionality of the web management portal. The vulnerability stems from improper validation of user-supplied file paths, allowing an attacker to manipulate the requested path and navigate outside the intended directory. By exploiting this vulnerability, an attacker can access and download files outside the designated system logs directory, potentially exposing sensitive system and application files. Please update your server to the latest SME server update.

DigitalCanion SA has discovered a vulnerability in the domain creation functionality of Koozali SME Server version 11.0rc1-215. The vulnerability arises from improper validation of user-supplied input before it is inserted into the Apache HTTP Server configuration. An attacker can inject reserved Apache configuration directives, corrupting httpd.conf and preventing Apache from starting after a server reboot. This results in a denial-of-service (DoS) condition affecting the web server and its hosted virtual hosts. The vulnerability is fixed on 11.0.0-228.sme

DigitalCanion SA identified a Zip Slip vulnerability (path traversal during archive extraction, CWE-22) in the Appliance Management Console (AMC) of SonicWall SMA1000 appliances. An authenticated administrator can, using a specially crafted archive, write files outside the intended destination directory and achieve remote code execution on the appliance. Reported on 21 July 2026 through the Zero Day Initiative (ZDI-CAN-28924), it was published on 6 October 2026 as CVE-2026-102257 (CVSS 7.2, High) in SonicWall advisory SNWLID-2026-0017.

Affected products: SMA1000 models 6210, 7210 and 8200v, versions 12.4.3-03526 and earlier, 12.5.0-02952 and earlier. Fixed in platform-hotfix 12.4.3-03670 and 12.5.0-03082. Vector CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. SonicWall credits "Brian Mariani through ZDI (Zero Day Initiative) Trend Micro, ZDI-CAN-28924". The advisory was released alongside the critical CVE-2026-102255 (pre-authentication SSRF, CVSS 10.0), which earned it wide coverage: CERT-FR, The Hacker News, SecurityWeek, Cybersecurity News, Rapid7. The corresponding ZDI advisory, ZDI-26-770, was published on 15 October 2026.

DigitalCanion SA identified a stored Cross-Site Scripting vulnerability (CWE-79) in the Appliance Management Console (AMC) of SonicWall SMA1000 appliances. A remote attacker authenticated as administrator can, under specific conditions, store and execute arbitrary JavaScript code in the console. Published on 6 October 2026 as CVE-2026-102258 (CVSS 5.5, Medium) in SonicWall advisory SNWLID-2026-0017, which credits "Brian Mariani, DigitalCanion SA".

Affected products: SMA1000 models 6210, 7210 and 8200v, versions 12.4.3-03526 and earlier, 12.5.0-02952 and earlier. Fixed in platform-hotfix 12.4.3-03670 and 12.5.0-03082. Vector CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N. SonicWall firewalls (SSL-VPN) and the SMA 100 series are not affected. No known exploitation at the time of publication.

The backup restoration mechanism of Mitel MiVoice Office 400 fails to validate the paths, file types, integrity and authenticity of files contained in TGZ archives. An attacker with access to the backup repository can introduce malicious files that are written to the system during restoration, up to arbitrary code execution with root privileges.

CVSS 4.0 score of 8.5 (High), the highest of the eight published CVEs. Network vector, high privileges required, total impact on confidentiality, integrity and availability of the system and adjacent components.

Published on 5 October 2026 in the global CVE registry by the National Cyber Security Centre NCSC (the Swiss Confederation's CVE Numbering Authority). Affected product: Mitel MiVoice Office 400 version 11.0.96.0 (Linux). Found by DigitalCanion SA (researcher: Brian Mariani, credited on the CVE record).

Weaknesses (CWE): CWE-22 · CWE-73 · CWE-494 · CWE-345 · CWE-434

A path traversal in the Mitel MiVoice Office 400 administration portal (https://<ip>:8443, Administration → View Logs menu) allows reading sensitive system files outside the intended directory.

CVSS 4.0 score of 8.4 (High). Local vector, high privileges required, high impact on confidentiality, integrity and availability, including adjacent components.

Published on 5 October 2026 in the global CVE registry by the National Cyber Security Centre NCSC (the Swiss Confederation's CVE Numbering Authority). Affected product: Mitel MiVoice Office 400 version 11.0.96.0 (Linux). Found by DigitalCanion SA, credited on the CVE record.

Weaknesses (CWE): CWE-31

Mitel MiVoice Office 400 loads shared libraries (.so) using predictable names and without integrity verification. An attacker can make the system load an attacker-controlled .so file instead of the legitimate module; the code runs with the process privileges and leads to full compromise of the virtual machine.

CVSS 4.0 score of 8.4 (High). Local vector, high privileges required, high impact on confidentiality, integrity and availability.

Published on 5 October 2026 in the global CVE registry by the National Cyber Security Centre NCSC (the Swiss Confederation's CVE Numbering Authority). Affected product: Mitel MiVoice Office 400 version 11.0.96.0 (Linux). Found by DigitalCanion SA (researcher: Brian Mariani, credited on the CVE record).

Weaknesses (CWE): CWE-426 · CWE-427 · CWE-73 · CWE-494 · CWE-829

The File Management feature of the Mitel MiVoice Office 400 web portal does not properly validate paths: an authenticated user can traverse directories and delete critical application or system files, causing a denial of service.

CVSS 4.0 score of 8.4 (High). Authentication required, high impact on confidentiality, integrity and availability.

Published on 5 October 2026 in the global CVE registry by the National Cyber Security Centre NCSC (the Swiss Confederation's CVE Numbering Authority). Affected product: Mitel MiVoice Office 400 version 11.0.96.0 (Linux). Found by DigitalCanion SA, credited on the CVE record.

Weaknesses (CWE): CWE-31

The Music on Hold feature of Mitel MiVoice Office 400 improperly validates uploaded files: an attacker can upload a malicious shared object (.so) disguised as a WAV audio file, leading to arbitrary code execution and system compromise.

CVSS 4.0 score of 8.4 (High). Local vector, high privileges required, high impact on confidentiality, integrity and availability.

Published on 5 October 2026 in the global CVE registry by the National Cyber Security Centre NCSC (the Swiss Confederation's CVE Numbering Authority). Affected product: Mitel MiVoice Office 400 version 11.0.96.0 (Linux). Found by DigitalCanion SA (researcher: Brian Mariani, credited on the CVE record).

Weaknesses (CWE): CWE-434 · CWE-20 · CWE-94 · CWE-829

The System Logs feature of the Mitel MiVoice Office 400 web management portal (TCP 443) fails to properly validate file paths, allowing an attacker to read files outside the intended directory.

CVSS 4.0 score of 5.5 (Medium). Network vector, high privileges required, high impact on confidentiality only.

Published on 5 October 2026 in the global CVE registry by the National Cyber Security Centre NCSC (the Swiss Confederation's CVE Numbering Authority). Affected product: Mitel MiVoice Office 400 version 11.0.96.0 (Linux). Found by DigitalCanion SA, credited on the CVE record.

Weaknesses (CWE): CWE-31

An authenticated attacker can inject JavaScript into the "Description" field under Configuration → Domains in the Mitel MiVoice Office 400 web portal (TCP 443). The input is not sanitised: the persistent script runs for other users (page manipulation, content injection, phishing).

CVSS 4.0 score of 1.9 (Low). High privileges and user interaction required, low impact.

Published on 5 October 2026 in the global CVE registry by the National Cyber Security Centre NCSC (the Swiss Confederation's CVE Numbering Authority). Affected product: Mitel MiVoice Office 400 version 11.0.96.0 (Linux). Found by DigitalCanion SA (researcher: Brian Mariani, credited on the CVE record).

Weaknesses (CWE): CWE-79

An authenticated attacker can inject JavaScript into the "Microsoft Exchange mailbox" field of the Mitel MiVoice Office 400 user configuration. The stored script runs whenever the user properties are accessed and can cause a denial of service of the interface.

CVSS 4.0 score of 1.9 (Low). High privileges and user interaction required, low impact.

Published on 5 October 2026 in the global CVE registry by the National Cyber Security Centre NCSC (the Swiss Confederation's CVE Numbering Authority). Affected product: Mitel MiVoice Office 400 version 11.0.96.0 (Linux). Found by DigitalCanion SA, credited on the CVE record.

Weaknesses (CWE): CWE-79

DigitalCanion SA, through its researcher Brian Mariani, identified a high-severity vulnerability in a Kyocera product, rated CVSS 7.1 (High). Referenced as DGI-SWISS-00034, it has been reported to the vendor and is undergoing coordinated disclosure. Technical details and the CVE identifier will be published once the embargo period ends; this page will be updated upon release.

DigitalCanion SA, through its researcher Brian Mariani, identified an uncontrolled resource consumption vulnerability (CWE-400 / CWE-770) in WatchGuard Fireware OS, the operating system of Firebox firewalls. A low-privileged, authenticated user can cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI. Referenced as DGI-SWISS-00024 and reported to the vendor on September 1, 2026, it was assigned CVE-2026-18105 with a CVSS 7.1 (High, v4.0) score in the official WatchGuard PSIRT advisory of September 29, 2026, which credits "Brian Mariani of DigitalCanion SA". Affected versions: Fireware OS 2026.3 to 2026.3.1, 2025.0 to 2026.2.2, 12.0 to 12.12.2 and 12.0 to 12.5.20 (T15/T35). Fixed in Fireware OS 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21. No known exploitation in the wild. The vulnerability is now public: a fix is available and Firebox users are advised to update Fireware OS without delay.

Mitel is the market leader in unified communications. Mitel MiVoice Office 400 to version R7.2 SP1, running Linux Release 11.0.96.0, does not implement Secure Boot, UEFI Secure Boot, boot/filesystem integrity protection, or LUKS disk encryption.

A malicious person or an attacker with access to the VMDK could therefore modify the virtual disk offline and inject persistent malicious code without being detected. Such code could execute automatically at system startup or when specific application features are triggered, allowing persistence across reboots, since there's no integrity check on system files. This exposes the solution to offline disk tampering, persistent code injection, boot-chain compromise, and lack of integrity verification. The absence of these controls significantly weakens the appliance's trust model and protection against persistent compromise.

Critical vulnerability in a Mitel product, rated CVSS 9.1. Reported on 1 September 2026 and undergoing coordinated disclosure ahead of public CVE publication. Discovered by Brian Mariani.

High-severity vulnerability in a Mitel product, rated CVSS 7.1. Reported on 1 September 2026 and undergoing coordinated disclosure ahead of public CVE publication. Discovered by DigitalCanion SA.

DigitalCanion SA identified multiple Cross-Site Scripting vulnerabilities in OPNsense 26.7.1_1, responsibly disclosed and published by the vendor in its GitHub security advisory (GHSA-9h93-hhcx-957c, 12 August 2026). The first is a stored Cross-Site Scripting (Description field under Interfaces → Assignments): an attacker can inject JavaScript that executes for any user viewing the interface configuration, including root accounts. The second is a reflected Cross-Site Scripting in Firewall → Log Files → Live View. Weaknesses: CWE-79 (Cross-site Scripting) and CWE-116 (improper output encoding/escaping). Severity: Low. This vulnerability is referenced under CVE-2026-115425.

DigitalCanion SA identified a command injection vulnerability in SonicWall Email Security (ES 5000/5050/7000/7050/9000 appliances, VMware and Hyper-V), version 10.0.35.8405 and earlier. An authenticated attacker with access to the restricted CLI can inject OS commands executed as root via the SNMP parameter. Reported on April 16, 2026 and coordinated through the Zero Day Initiative (ZDI-CAN-29029), it was published on August 11, 2026 as CVE-2026-66150 (CVSS 7.8, High) in ZDI advisory ZDI-26-530 and SonicWall advisory SNWLID-2026-0012. Fixed in Email Security 10.0.36.

DigitalCanion SA, through its researcher Brian Mariani, identified a command injection vulnerability in SonicWall Email Security (ES 5000/5050/7000/7050/9000 appliances, VMware and Hyper-V), version 10.0.35.8405 and earlier. An authenticated attacker with access to the restricted CLI can inject OS commands executed as root via the netmask (updateNetIf) parameter. Reported on April 16, 2026 and coordinated through the Zero Day Initiative (ZDI-CAN-29025), it was published on August 11, 2026 as CVE-2026-66149 (CVSS 7.8, High) in ZDI advisory ZDI-26-532 and SonicWall advisory SNWLID-2026-0012. Fixed in Email Security 10.0.36.

DigitalCanion SA identified a security vulnerability affecting SonicWall products and responsibly disclosed it through the Zero Day Initiative (ZDI). The vulnerability was assigned the identifier ZDI-CAN-29024 and was rated CVSS 7.8 (High). The issue was reported on April 16, 2026, and coordinated through ZDI's responsible disclosure process. It is now published as CVE-2026-66148 in SonicWall advisory SNWLID-2026-0011 and ZDI advisory ZDI-26-531. This discovery reflects DigitalCanion's ongoing commitment to proactive security research and responsible vulnerability disclosure.

Two vulnerabilities discovered and disclosed by DigitalCanion SA in SonicWall GMS 9.5.1 and earlier versions. CVE-2026-66148 (CVSS 6.3): an authenticated command injection allowing a low-privileged local user to execute system commands with root privileges, originally coordinated through the Zero Day Initiative (ZDI-CAN-29024). CVE-2026-66146 (CVSS 5.5): multiple Cross-Site Scripting vulnerabilities allowing execution of JavaScript in a user's browser. Published in the official SonicWall advisory SNWLID-2026-0011 of August 11, 2026, and fixed by the vendor in GMS 9.5.2.

A vulnerability discovered in VMware 17.6. Although Broadcom acknowledged the issue, it stated it would only resolve it "in upcoming versions", with no clear timeline. A full technical report documents the finding.

An attacker with R/W access to the VM's storage can tamper with system binaries. Modifying the SSH daemon injects an arbitrary shell, guaranteeing highly persistent remote access that survives reboots, despite deceptive integrity-validation messages. Furthermore, cleartext communication between the GUI and the backend enables theft of administrator credentials. Sophos declined to fix these design flaws; no patch is expected.

While this attack requires prior access to the virtual machine's disks, that constraint cannot justify the absence of adequate protection mechanisms. As it stands, the Sophos firewall solution shows significant shortcomings in reliability and resilience against unauthorized modifications of its files.

File integrity verification at startup is a fundamental security measure for this type of solution. Had an integrity-checking mechanism been implemented, any unauthorized modification would have been detected and corrected at the next reboot or update. The persistence of the attack would then have been limited to the interval before the system's next reboot or update.

We immediately reported this vulnerability to Sophos. However, the vendor declined to implement the security mechanisms needed to address this weakness.

Multiple critical vulnerabilities affecting SonicWall SSL VPN. Although their exploitation requires read and write access to the machine's virtual disk, this demonstration illustrates how quickly a malicious insider, or an attacker who has obtained such access, can compromise the security of the SSL VPN system. Despite their impact, these design flaws were not fixed by SonicWall. This solution is now end-of-life and no longer maintained.

Three vulnerabilities identified in the SonicWall Email Security (antispam) solution that may put the email infrastructure at risk: CVE-2026-3468, CVE-2026-3469 and CVE-2026-3470. Prompt remediation is essential to reduce exposure of a critical messaging layer.

Two security vulnerabilities identified and disclosed in SonicWall products, reported through the appropriate channels and fixed by the vendor. An illustration of the importance of continuous security testing, transparency and responsible disclosure.

A vulnerability affecting a Novell product (vendor-internal reference: bug 874533), published in the global registry as CVE-2014-0610. This research is part of the track record of Brian Mariani, now a cybersecurity expert at DigitalCanion SA. Full technical details are available in the reference entries below (Shodan, Tenable, VulDB, Debian, the CVE registry and NVD).

Vulnerability published by Apple in the QuickTime 7.3.1 security bulletin. This research is part of the track record of Brian Mariani (then a researcher at Syseclabs), now a cybersecurity expert at DigitalCanion SA.

CVE ID: CVE-2007-4707Available for: Mac OS X v10.3.9, Mac OS X v10.4.9 or later, Mac OS X v10.5 or later, Windows Vista and Windows XP SP2.Impact: QuickTime's Flash media handler contains multiple security vulnerabilities.

Description: Multiple vulnerabilities were identified in QuickTime's Flash media handler; the most serious could allow an attacker to execute arbitrary code on the computer. Apple addressed the issue by disabling the Flash media handler in QuickTime, except for a limited number of existing QuickTime movies considered safe. In its security bulletin, Apple credits Tom Ferris of the Adobe Secure Software Engineering Team (ASSET), Mike Price of McAfee Avert Labs, security researchers Lionel d'Hauenens and Brian Mariani of Syseclabs, and an anonymous researcher working with TippingPoint's Zero Day Initiative for reporting this issue.