CVE-2026-0205
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A post-authentication path traversal vulnerability in SonicOS allows an attacker to interact with usually restricted services. The attacker must be authenticated to exploit this flaw.
Risk Assessment
An authenticated attacker could access services that should normally be restricted, potentially leading to privilege escalation or further attacks. This may compromise the security of the SonicWall firewall.
Recommendation
Update SonicOS to the latest version containing the fix. Restrict access to the management interface to trusted networks only.
Other vulnerabilities in SonicOS
See all- CVE-2020-5135CriticalActively exploited
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause a Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. It affects SonicOS Gen 6 versions 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0.
- CVE-2026-0516Medium
SonicOS contains a vulnerability related to improper neutralization of HTTP headers for scripting syntax. A remote attacker can manipulate the Host header and redirect firewall management users to arbitrary web domains.
- CVE-2026-0206Medium
A post-authentication stack-based buffer overflow vulnerability in SonicOS allows a remote attacker to crash a firewall.
- CVE-2026-0204High
A vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be accessible under specific conditions.
Original NVD description (English source)
A post-authentication Path Traversal vulnerability in SonicOS allows an attacker to interact with usually restricted services.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS