# CVE-2026-3470: SonicWall Email Security database corruption via improper input sanitization

Source: https://junglewise.ai/threats/cve-2026-3470-sonicwall-email-security-database-corruption-via-improper-input  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-31. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-3470 · Severity: low · CVSS 3.8 · Published 2026-03-31

A vulnerability in SonicWall Email Security appliances could allow an authorized administrator to inadvertently or maliciously corrupt the system's database. This appliance is used to protect corporate email from threats like spam and phishing. While the risk is low because it requires high-level administrative access, an exploit could lead to data integrity issues or service disruptions within the email security environment.

Technologies: [SonicWall Email Security](https://junglewise.ai/threats/technologies/email-security), [SonicWall Esa5000](https://junglewise.ai/threats/technologies/esa5000), [SonicWall Esa5050](https://junglewise.ai/threats/technologies/esa5050), [SonicWall Esa7000](https://junglewise.ai/threats/technologies/esa7000), [SonicWall Esa7050](https://junglewise.ai/threats/technologies/esa7050), [SonicWall Esa9000](https://junglewise.ai/threats/technologies/esa9000). Vendors: [SonicWall](https://junglewise.ai/threats/vendors/sonicwall).

## Quick answers

**Is CVE-2026-3470 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-3470 being exploited in the wild.

**How severe is CVE-2026-3470?** Low severity, with a CVSS score of 3.8, published 31 March 2026.

**Which products and versions are affected?** SonicWall Email Security 10.0.34.8215 and earlier; 10.0.34.8223 and earlier.

**Is there a fix for CVE-2026-3470?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-3470 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-3470?** Check whether you run SonicWall Email Security, SonicWall Esa5000, SonicWall Esa5050 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper input validation vulnerability (CWE-20) exists in the SonicWall Email Security appliance. The flaw is located in the input sanitization mechanisms, where crafted input provided by a remote authenticated user with administrative privileges (PR:H) can lead to data corruption within the application database. The attack vector is network-based and does not require user interaction. While the impact is limited to integrity and availability of the database, it requires high-level credentials to execute. Affected versions include 10.0.34.8215, 10.0.34.8223, and earlier.

## Affected products

- SonicWall Email Security 10.0.34.8215 and earlier; 10.0.34.8223 and earlier

## Timeline

- 2026-03-31: disclosed
- 2026-03-31: advisory

## References

- [https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0002](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0002)

## Related threats

- [SonicWall Email Security denial of service via improper input validation](https://junglewise.ai/threats/cve-2026-3469-sonicwall-email-security-denial-of-service-via-improper-input)
- [SonicWall Email Security stored XSS](https://junglewise.ai/threats/cve-2026-3468-sonicwall-email-security-stored-xss)