CVE-2026-107155
HighCVSS 8.8Summary
A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface. Under specific conditions it could potentially enable a remote unauthenticated attacker to perform unauthorized operations.
Risk Assessment
An unauthenticated attacker could potentially perform unauthorized actions in the management interface, threatening device integrity and security. It requires specific configuration conditions.
Recommendation
Apply available SonicOS updates that fix the vulnerability and restrict management interface access to trusted networks. Review cross-domain policy configuration.
Other vulnerabilities in SonicOS
See all- CVE-2026-82308Unknown
A pre-authentication heap-based buffer overflow vulnerability was identified in the SonicOS SSL-VPN service. It could allow a remote unauthenticated attacker to cause an application-level denial of service.
- CVE-2026-77709Unknown
A pre-authentication heap-based buffer overflow vulnerability was identified in the SonicOS TACACS+ authentication client. Under specific conditions it could allow a remote unauthenticated attacker to cause an application-level denial of service.
- CVE-2026-77708Unknown
A pre-authentication stack-based buffer overflow vulnerability was identified in the SonicOS TACACS+ authentication client. Under specific conditions it could allow a remote unauthenticated attacker to cause an application-level denial of service.
- CVE-2026-19703Unknown
A weak password hashing vulnerability has been identified on SonicOS virtual appliances. Under specific conditions, an attacker with existing local access could disclose a platform credential that grants access to a limited subset of platform settings.
- CVE-2026-107154High
A session validation vulnerability has been identified in the SonicOS management interface. Under specific conditions it could potentially enable a remote unauthenticated attacker to perform unauthorized operations.
- CVE-2026-19868UnknownActively exploited
An authentication enforcement vulnerability in the SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).
- CVE-2020-5135CriticalActively exploited
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause a Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. It affects SonicOS Gen 6 versions 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0.
- CVE-2026-0516Medium
SonicOS contains a vulnerability related to improper neutralization of HTTP headers for scripting syntax. A remote attacker can manipulate the Host header and redirect firewall management users to arbitrary web domains.
- CVE-2026-0206Medium
A post-authentication stack-based buffer overflow vulnerability in SonicOS allows a remote attacker to crash a firewall.
- CVE-2026-0205Medium
A post-authentication path traversal vulnerability in SonicOS allows an attacker to interact with usually restricted services. The attacker must be authenticated to exploit this flaw.
Original NVD description (English source)
A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS