{"id":232,"created_when":"2026-11-06T10:40:08Z","created_by":"arun","updated_when":"2026-11-06T10:40:08Z","updated_by":"arun","advisory_id":"SNWLID-2026-0014","title":"SonicWall SonicOS Affected By Multiple Vulnerabilities","published_when":"2026-11-06T10:40:08Z","last_updated_when":"2026-11-06T10:40:08Z","impact":"high","cvss":"8.8","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_version":3.0,"cwe":"CWE-121, CWE-122, CWE-942, CWE-798, CWE-916, CWE-308, CWE-291","cve":"CVE-2026-77708, CVE-2026-77709, CVE-2026-82308, CVE-2026-107154, CVE-2026-107155, CVE-2026-19703, CVE-2026-19868","cpe":"","summary":"

1) CVE-2026-107155 - Permissive Cross-domain Policy Vulnerability

A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.

CVSS Score: 8.8
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains

2) CVE-2026-107154 - Session Validation Vulnerability

A session validation vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.

CVSS Score: 8.8
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-291: Reliance on IP Address for Authentication

3) CVE-2026-82308 - Pre-authentication Heap Buffer Overflow Vulnerability in SSL-VPN

A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS SSL-VPN service, which could potentially enable a remote unauthenticated attacker to cause an application level denial of service.

CVSS Score: 7.5
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-122: Heap-based Buffer Overflow

4) CVE-2026-19868 - SSLVPN Authentication Enforcement Vulnerability via Alternate Authentication Methods

An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).

IMPORTANT: SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability. Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks.

NOTE: This vulnerability ONLY impacts the SonicOS SSLVPN interface or service if SAML is enabled for SSLVPN logins.

CVSS Score: 7.1
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
CWE-308: Use of Single-factor Authentication

5) CVE-2026-77708 - Pre-authentication Stack Buffer Overflow Vulnerability in TACACS+

A pre-authentication stack-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in specific conditions could potentially enable a remote unauthenticated attacker to cause an application level denial of service.

CVSS Score: 5.9
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-121: Stack-based Buffer Overflow

6) CVE-2026-77709 - Pre-authentication Heap Buffer Overflow Vulnerability in TACACS+

A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in specific conditions could potentially enable a remote unauthenticated attacker to cause an application level denial of service.

CVSS Score: 5.9
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-122: Heap-based Buffer Overflow

7) CVE-2026-19703 - Weak Password Hashing

A weak password hashing vulnerability has been identified on SonicOS virtual appliances, which in specific conditions could potentially enable an attacker with existing local access to disclose a platform credential. The credential provides access to a limited subset of platform settings.

CVSS Score: 5.2
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
CWE-916: Use of Password Hash With Insufficient Computational Effort
CWE-798: Use of Hard-coded Credentials

","is_workaround_available":false,"workaround":"None.","detail":"","affected_products":"

Affected Platforms

Affected Versions


Gen7 Hardware Firewalls - TZ 270, TZ 270W, TZ 370, TZ 370W, TZ 470, TZ 470W, TZ 570, TZ 570W, TZ 570P, TZ 670,

NSa 2700, NSa 3700, NSa 4700, NSa 5700, NSa 6700, 

NSsp 10700, NSsp 11700, NSsp 13700, NSsp 15700

Gen7 NSv - NSv 270, NSv 470, NSv 870 (ESX, KVM, HYPER-V, AWS, Azure)




7.3.3-7015 and older versions.


Gen8 Hardware Firewalls - TZ 80, TZ 280, TZ 280W, TZ 380, TZ 380W, TZ 480, TZ 580, TZ 680,

NSa 2800, NSa 3800, NSa 4800, NSa 5800

Gen8 NSv - NSv XS, NSv S, NSv M, NSv L (ESX, KVM, HYPER-V, AWS, Azure)



8.2.2-8015 and older versions


","fixed_software":"

Fixed Platforms

Fixed Versions


Gen7 Hardware Firewalls - TZ 270, TZ 270W, TZ 370, TZ 370W, TZ 470, TZ 470W, TZ 570, TZ 570W, TZ 570P, TZ 670,

NSa 2700, NSa 3700, NSa 4700, NSa 5700, NSa 6700, 

NSsp 10700, NSsp 11700, NSsp 13700, NSsp 15700

Gen7 NSv - NSv 270, NSv 470, NSv 870 (ESX, KVM, HYPER-V, AWS, Azure)



7.3.4-7013 and higher versions


Gen8 Hardware Firewalls - TZ 80, TZ 280, TZ 280W, TZ 380, TZ 380W, TZ 480, TZ 580, TZ 680,

NSa 2800, NSa 3800, NSa 4800, NSa 5800

Gen8 NSv - NSv XS, NSv S, NSv M, NSv L (ESX, KVM, HYPER-V, AWS, Azure)



8.2.3-8015 and higher versions

","credits":"

Vulnerabilities

Reported By

CVE-2026-77708, CVE-2026-77709, CVE-2026-82308Matei \"Mal\" Badanoiu of Pentest-Tools.com - PTT-2026-018, PTT-2026-019, PTT-2026-013
CVE-2026-107154, CVE-2026-107155Offensive Security Research Team of Pentest-Tools.com - PTT-2026-021
CVE-2026-19703Dr. Gianpiero Costantino of Agenzia per la Cybersicurezza Nazionale (ACN)
CVE-2026-19868Ryan Harris of The Electronic Office


","revision_history":"\r\n\r\n","references":"","vuln_status":"Applicable","status":"published","is_published":true,"patterns":[],"vulnerable_products":[{"id":3,"name":"SonicOS Gen7 Platform - TZ/NSa/NSsp/NSv"},{"id":32,"name":"SonicOS Gen8 Platform - TZ/NSa"}]}