SonicOS Improper Neutralization of HTTP Headers Vulnerability
SNWLID-2026-0009
Summary
1) CVE-2026-107155 - Permissive Cross-domain Policy Vulnerability
A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.
CVSS Score: 8.8
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains
2) CVE-2026-107154 - Session Validation Vulnerability
A session validation vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.
CVSS Score: 8.8
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-291: Reliance on IP Address for Authentication
3) CVE-2026-82308 - Pre-authentication Heap Buffer Overflow Vulnerability in SSL-VPN
A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS SSL-VPN service, which could potentially enable a remote unauthenticated attacker to cause an application level denial of service.
CVSS Score: 7.5
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-122: Heap-based Buffer Overflow
4) CVE-2026-19868 - SSLVPN Authentication Enforcement Vulnerability via Alternate Authentication Methods
An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).
IMPORTANT: SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability. Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks.
NOTE: This vulnerability ONLY impacts the SonicOS SSLVPN interface or service if SAML is enabled for SSLVPN logins.
CVSS Score: 7.1
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
CWE-308: Use of Single-factor Authentication
5) CVE-2026-77708 - Pre-authentication Stack Buffer Overflow Vulnerability in TACACS+
A pre-authentication stack-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in specific conditions could potentially enable a remote unauthenticated attacker to cause an application level denial of service.
CVSS Score: 5.9
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-121: Stack-based Buffer Overflow
6) CVE-2026-77709 - Pre-authentication Heap Buffer Overflow Vulnerability in TACACS+
A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in specific conditions could potentially enable a remote unauthenticated attacker to cause an application level denial of service.
CVSS Score: 5.9
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-122: Heap-based Buffer Overflow
7) CVE-2026-19703 - Weak Password Hashing
A weak password hashing vulnerability has been identified on SonicOS virtual appliances, which in specific conditions could potentially enable an attacker with existing local access to disclose a platform credential. The credential provides access to a limited subset of platform settings.
CVSS Score: 5.2
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
CWE-916: Use of Password Hash With Insufficient Computational Effort
CWE-798: Use of Hard-coded Credentials
Products covered
Affected Platforms: Affected Versions
Gen7 Hardware Firewalls - TZ 270, TZ 270W, TZ 370, TZ 370W, TZ 470, TZ 470W, TZ 570, TZ 570W, TZ 570P, TZ 670, NSa 2700, NSa 3700, NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700, NSsp 15700 Gen7 NSv - NSv 270, NSv 470, NSv 870 (ESX, KVM, HYPER-V, AWS, Azure): 7.3.3-7015 and older versions.
Gen8 Hardware Firewalls - TZ 80, TZ 280, TZ 280W, TZ 380, TZ 380W, TZ 480, TZ 580, TZ 680, NSa 2800, NSa 3800, NSa 4800, NSa 5800 Gen8 NSv - NSv XS, NSv S, NSv M, NSv L (ESX, KVM, HYPER-V, AWS, Azure): 8.2.2-8015 and older versions
Remediation
Install the applicable fixed SonicWall release for your product and branch.
Vendor-listed fixes
Fixed Platforms: Fixed Versions
Gen7 Hardware Firewalls - TZ 270, TZ 270W, TZ 370, TZ 370W, TZ 470, TZ 470W, TZ 570, TZ 570W, TZ 570P, TZ 670, NSa 2700, NSa 3700, NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700, NSsp 15700 Gen7 NSv - NSv 270, NSv 470, NSv 870 (ESX, KVM, HYPER-V, AWS, Azure): 7.3.4-7013 and higher versions
Gen8 Hardware Firewalls - TZ 80, TZ 280, TZ 280W, TZ 380, TZ 380W, TZ 480, TZ 580, TZ 680, NSa 2800, NSa 3800, NSa 4800, NSa 5800 Gen8 NSv - NSv XS, NSv S, NSv M, NSv L (ESX, KVM, HYPER-V, AWS, Azure): 8.2.3-8015 and higher versions
CVEs in this advisory 7
Updates
- Published by SonicWall
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.