CVE-2026-66151: SonicWall Global VPN Client DoS Vulnerability

CVE-2026-66151 Overview

CVE-2026-66151 is an out-of-bounds kernel memory read vulnerability in the SonicWall Global VPN Client. The flaw resides in the SWIPsec.sys kernel driver shipped with version 4.10.8.1108 and earlier. A local, authenticated attacker can trigger the condition to cause a system crash, resulting in denial of service on the affected host. The vulnerability is classified as [CWE-125] Out-of-Bounds Read.

Critical Impact
Local attackers with low privileges can crash Windows systems running vulnerable SonicWall Global VPN Client installations by triggering an out-of-bounds kernel read in SWIPsec.sys.

Affected Products

SonicWall Global VPN Client version 4.10.8.1108
SonicWall Global VPN Client versions prior to 4.10.8.1108
Windows systems with the SWIPsec.sys driver loaded

Discovery Timeline

2026-08-07 - CVE-2026-66151 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-66151

Vulnerability Analysis

The vulnerability exists in SWIPsec.sys, a kernel-mode driver installed by the SonicWall Global VPN Client to handle IPsec traffic. The driver reads memory outside the bounds of an allocated buffer while processing input from user mode. Because the read occurs in kernel context, an invalid access triggers a bug check and forces the operating system to crash.

The issue is limited to availability impact. The vector string indicates no confidentiality or integrity impact, and exploitation requires local access with low privileges. No authentication beyond a standard user session is needed to reach the vulnerable code path.

EPSS data reflects a low near-term likelihood of active exploitation, and no public exploit is currently listed in Exploit-DB or CISA KEV. However, driver-level denial of service remains attractive for attackers seeking to disable endpoint tooling or destabilize workstations during intrusions.

Root Cause

The root cause is missing or insufficient bounds validation within an I/O handler in SWIPsec.sys. When the driver processes a crafted request, it dereferences a pointer or index that extends past the allocated buffer, reading adjacent kernel memory. The invalid read triggers an access violation that the kernel resolves with a bug check.

Attack Vector

Exploitation requires local code execution on the target Windows host. An attacker with a standard user account sends a malformed request (such as a crafted DeviceIoControl call) to the vulnerable driver interface exposed by SWIPsec.sys. The driver processes the request without validating buffer boundaries, performs the out-of-bounds read, and crashes the system.

The vulnerability cannot be triggered remotely and does not grant code execution or information disclosure based on available advisory data. See the SonicWall Vulnerability Advisory SNWLID-2026-0010 for vendor-supplied technical detail.

Detection Methods for CVE-2026-66151

Indicators of Compromise

Unexpected Windows bug check events (BSOD) on hosts running SonicWall Global VPN Client 4.10.8.1108 or earlier
Presence of SWIPsec.sys at a version predating the fixed release
Repeated crash dumps referencing SWIPsec.sys in the faulting module stack

Detection Strategies

Inventory endpoints for installed versions of SonicWall Global VPN Client and flag hosts running 4.10.8.1108 or earlier.
Correlate Windows Error Reporting and MEMORY.DMP artifacts against processes issuing DeviceIoControl calls to SWIPsec.sys.
Alert on non-administrative processes opening handles to the SonicWall IPsec driver device object.

Monitoring Recommendations

Ingest Windows Event Log channels System (Event ID 1001) and Application for repeated crash signatures citing SWIPsec.sys.
Track kernel crash telemetry across the fleet and pivot on hosts with recurring faults tied to the same driver.
Review EDR process telemetry for low-privileged processes interacting with kernel driver interfaces.

How to Mitigate CVE-2026-66151

Immediate Actions Required

Identify all endpoints running SonicWall Global VPN Client 4.10.8.1108 or earlier and prioritize them for update.
Apply the fixed release published by SonicWall as referenced in advisory SNWLID-2026-0010.
Restrict local logon rights on shared or multi-user Windows systems where the client is installed.

Patch Information

SonicWall published fix guidance in the SonicWall Vulnerability Advisory SNWLID-2026-0010. Administrators should upgrade the Global VPN Client to the version identified by SonicWall as containing the corrected SWIPsec.sys driver.

Workarounds

Uninstall the SonicWall Global VPN Client on systems that do not require it until patching completes.
Enforce least privilege so untrusted users cannot log on locally to hosts with the vulnerable driver loaded.
Where feasible, migrate users to an alternative supported SonicWall client that is not affected by this advisory.

bash

# Query installed SonicWall Global VPN Client version on Windows
wmic product where "Name like 'SonicWall Global VPN Client%%'" get Name,Version

# Check the SWIPsec.sys driver file version
powershell -Command "(Get-Item C:\Windows\System32\drivers\SWIPsec.sys).VersionInfo"