# SonicWall SonicOS vulnerabilities Source: https://junglewise.ai/threats/technologies/sonicos Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 10 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/sonicos.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 20 vulnerabilities in SonicWall SonicOS: 7 in the last 7 days and 7 in the last 90 days, 5 of them critical and 4 exploited in the wild. The most recent, CVE-2026-82308, was published on 6 November 2026. 7 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0, 1 exploited in the wild against 0. ## Counts - Last 7 days: 7 - Last 30 days: 7 - Last 90 days: 7 - All time: 20 (5 critical, 4 exploited in the wild) ## About SonicWall SonicOS Operating system for SonicWall network security appliances. ## Latest SonicWall SonicOS vulnerabilities - [CVE-2026-82308: SonicWall SonicOS heap-based buffer overflow in SSL-VPN](https://junglewise.ai/threats/cve-2026-82308-a-pre-authentication-heap-based-buffer-overflow-vulnerability-has) (info, published 6 Nov 2026) - [CVE-2026-77709: SonicWall SonicOS heap buffer overflow in TACACS+ client](https://junglewise.ai/threats/cve-2026-77709-a-pre-authentication-heap-based-buffer-overflow-vulnerability-has) (info, published 6 Nov 2026) - [CVE-2026-77708: SonicWall SonicOS stack-based buffer overflow in TACACS+ client](https://junglewise.ai/threats/cve-2026-77708-a-pre-authentication-stack-based-buffer-overflow-vulnerability) (info, published 6 Nov 2026) - [CVE-2026-19868: SonicWall SonicOS SSLVPN SAML authentication bypass](https://junglewise.ai/threats/cve-2026-19868-an-authentication-enforcement-vulnerability-in-sonicos-sslvpn) (critical, exploited in the wild, published 6 Nov 2026) - [CVE-2026-19703: SonicWall SonicOS weak password hashing](https://junglewise.ai/threats/cve-2026-19703-a-weak-password-hashing-vulnerability-has-been-identified-on) (info, published 6 Nov 2026) - [CVE-2026-107155: SonicOS permissive cross-domain policy in management interface](https://junglewise.ai/threats/cve-2026-107155-a-permissive-cross-domain-policy-vulnerability-has-been) (high, CVSS 8.8, published 6 Nov 2026) - [CVE-2026-107154: SonicWall SonicOS session validation bypass in management interface](https://junglewise.ai/threats/cve-2026-107154-a-session-validation-vulnerability-has-been-identified-in-the) (high, CVSS 8.8, published 6 Nov 2026) - [CVE-2026-0206: A post-authentication Stack-based Buffer Overflow vulnerabilities in SonicOS allows a remote attacker to crash a firewall.](https://junglewise.ai/threats/cve-2026-0206-a-post-authentication-stack-based-buffer-overflow-vulnerabilities) (medium, CVSS 4.9, published 29 Apr 2026) - [CVE-2026-0205: A post-authentication Path Traversal vulnerability in SonicOS allows an attacker to interact with usually restricted…](https://junglewise.ai/threats/cve-2026-0205-a-post-authentication-path-traversal-vulnerability-in-sonicos) (medium, CVSS 6.8, published 29 Apr 2026) - [CVE-2026-0204: A vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be…](https://junglewise.ai/threats/cve-2026-0204-a-vulnerability-in-the-access-control-mechanism-of-sonicos-may) (high, CVSS 8, published 29 Apr 2026) - [CVE-2026-3439: A post-authentication Stack-based Buffer Overflow vulnerability in SonicOS certificate handling allows a remote…](https://junglewise.ai/threats/cve-2026-3439-a-post-authentication-stack-based-buffer-overflow-vulnerability-in) (medium, CVSS 4.9, published 4 Mar 2026) - [CVE-2026-0402: A post-authentication Out-of-bounds Read vulnerability in SonicOS allows a remote attacker to crash a firewall.](https://junglewise.ai/threats/cve-2026-0402-a-post-authentication-out-of-bounds-read-vulnerability-in-sonicos) (medium, CVSS 4.9, published 24 Feb 2026) - [CVE-2026-0401: A post-authentication NULL Pointer Dereference vulnerability in SonicOS allows a remote attacker to crash a firewall.](https://junglewise.ai/threats/cve-2026-0401-a-post-authentication-null-pointer-dereference-vulnerability-in) (medium, CVSS 4.9, published 24 Feb 2026) - [CVE-2026-0400: A post-authentication Format String vulnerability in SonicOS allows a remote attacker to crash a firewall.](https://junglewise.ai/threats/cve-2026-0400-a-post-authentication-format-string-vulnerability-in-sonicos) (medium, CVSS 4.9, published 24 Feb 2026) - [CVE-2026-0399: Multiple post-authentication stack-based buffer overflow vulnerabilities in the SonicOS management interface due to…](https://junglewise.ai/threats/cve-2026-0399-multiple-post-authentication-stack-based-buffer-overflow) (medium, CVSS 4.9, published 24 Feb 2026) - [CVE-2025-40601: A Stack-based buffer overflow vulnerability in the SonicOS SSLVPN service allows a remote unauthenticated attacker to…](https://junglewise.ai/threats/cve-2025-40601-a-stack-based-buffer-overflow-vulnerability-in-the-sonicos-sslvpn) (high, CVSS 7.5, published 20 Nov 2025) - [CVE-2024-53704: SonicWall SonicOS SSLVPN Improper Authentication Vulnerability](https://junglewise.ai/threats/cve-2024-53704-sonicwall-sonicos-sslvpn-improper-authentication-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 18 Feb 2025) - [CVE-2024-40766: SonicWall SonicOS Improper Access Control Vulnerability](https://junglewise.ai/threats/cve-2024-40766-sonicwall-sonicos-improper-access-control-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 9 Sep 2024) - [CVE-2024-3596: RADIUS Protocol MD5 collision forgery attack (Blast-RADIUS)](https://junglewise.ai/threats/cve-2024-3596-radius-protocol-md5-collision-forgery-attack-blast-radius) (critical, CVSS 9, published 9 Jul 2024) - [CVE-2020-5135: SonicWall SonicOS Buffer Overflow Vulnerability](https://junglewise.ai/threats/cve-2020-5135-sonicwall-sonicos-buffer-overflow-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 15 Mar 2022) ## Most severe SonicWall SonicOS vulnerabilities - [CVE-2024-53704: SonicWall SonicOS SSLVPN Improper Authentication Vulnerability](https://junglewise.ai/threats/cve-2024-53704-sonicwall-sonicos-sslvpn-improper-authentication-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 18 Feb 2025) - [CVE-2024-40766: SonicWall SonicOS Improper Access Control Vulnerability](https://junglewise.ai/threats/cve-2024-40766-sonicwall-sonicos-improper-access-control-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 9 Sep 2024) - [CVE-2020-5135: SonicWall SonicOS Buffer Overflow Vulnerability](https://junglewise.ai/threats/cve-2020-5135-sonicwall-sonicos-buffer-overflow-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 15 Mar 2022) - [CVE-2026-19868: SonicWall SonicOS SSLVPN SAML authentication bypass](https://junglewise.ai/threats/cve-2026-19868-an-authentication-enforcement-vulnerability-in-sonicos-sslvpn) (critical, exploited in the wild, published 6 Nov 2026) - [CVE-2024-3596: RADIUS Protocol MD5 collision forgery attack (Blast-RADIUS)](https://junglewise.ai/threats/cve-2024-3596-radius-protocol-md5-collision-forgery-attack-blast-radius) (critical, CVSS 9, published 9 Jul 2024) - [CVE-2026-107155: SonicOS permissive cross-domain policy in management interface](https://junglewise.ai/threats/cve-2026-107155-a-permissive-cross-domain-policy-vulnerability-has-been) (high, CVSS 8.8, published 6 Nov 2026) - [CVE-2026-107154: SonicWall SonicOS session validation bypass in management interface](https://junglewise.ai/threats/cve-2026-107154-a-session-validation-vulnerability-has-been-identified-in-the) (high, CVSS 8.8, published 6 Nov 2026) - [CVE-2026-0204: A vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be…](https://junglewise.ai/threats/cve-2026-0204-a-vulnerability-in-the-access-control-mechanism-of-sonicos-may) (high, CVSS 8, published 29 Apr 2026) - [CVE-2025-40601: A Stack-based buffer overflow vulnerability in the SonicOS SSLVPN service allows a remote unauthenticated attacker to…](https://junglewise.ai/threats/cve-2025-40601-a-stack-based-buffer-overflow-vulnerability-in-the-sonicos-sslvpn) (high, CVSS 7.5, published 20 Nov 2025) - [CVE-2026-0205: A post-authentication Path Traversal vulnerability in SonicOS allows an attacker to interact with usually restricted…](https://junglewise.ai/threats/cve-2026-0205-a-post-authentication-path-traversal-vulnerability-in-sonicos) (medium, CVSS 6.8, published 29 Apr 2026) ## Vulnerabilities per week 7 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0, 1 exploited in the wild against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 7 | 1 | 1 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other SonicWall technologies - [SonicWall Nsa 2700](https://junglewise.ai/threats/technologies/nsa-2700): 9 vulnerabilities - [SonicWall Nsa 2800](https://junglewise.ai/threats/technologies/nsa-2800): 9 vulnerabilities - [SonicWall Nsa 3700](https://junglewise.ai/threats/technologies/nsa-3700): 9 vulnerabilities - [SonicWall Nsa 3800](https://junglewise.ai/threats/technologies/nsa-3800): 9 vulnerabilities - [SonicWall Nsa 4700](https://junglewise.ai/threats/technologies/nsa-4700): 9 vulnerabilities - [SonicWall Nsa 4800](https://junglewise.ai/threats/technologies/nsa-4800): 9 vulnerabilities - [SonicWall Nsa 5700](https://junglewise.ai/threats/technologies/nsa-5700): 9 vulnerabilities - [SonicWall Nsa 5800](https://junglewise.ai/threats/technologies/nsa-5800): 9 vulnerabilities - [SonicWall Nsa 6700](https://junglewise.ai/threats/technologies/nsa-6700): 9 vulnerabilities - [SonicWall Nssp 10700](https://junglewise.ai/threats/technologies/nssp-10700): 9 vulnerabilities - [SonicWall Nssp 11700](https://junglewise.ai/threats/technologies/nssp-11700): 9 vulnerabilities - [SonicWall Nssp 13700](https://junglewise.ai/threats/technologies/nssp-13700): 9 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "SonicWall SonicOS vulnerabilities", https://junglewise.ai/threats/technologies/sonicos, 10 November 2026.