EUVD-2026-26255Severity by source
AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Post-authentication nature warrants PR:L; path traversal by an authenticated user requires no additional victim interaction, so UI:N.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A post-authentication Path Traversal vulnerability in SonicOS allows an attacker to interact with usually restricted services.
AnalysisAI
Path traversal in SonicWall SonicOS enables authenticated attackers on adjacent networks to access services that are normally restricted to privileged system internals. Affecting multiple SonicOS branches (6.x, 7.0.x, 7.3.x, 8.x), successful exploitation can result in high availability impact alongside limited confidentiality and integrity gains, per the CVSS impact metrics. No public exploit code has been identified and CISA SSVC confirms exploitation status as none, with EPSS at 0.01% (2nd percentile), indicating negligible in-the-wild exploitation pressure at time of analysis.
Technical ContextAI
SonicOS (CPE: cpe:2.3:a:sonicwall:sonicos:*:*:*:*:*:*:*:*) is SonicWall's proprietary firewall operating system powering their NGFWs and VPN appliances. The root cause is CWE-35 (Path Traversal), wherein attacker-controlled input containing path-manipulation sequences (e.g., '../') is not properly sanitized before being used to resolve service endpoints or file references within the OS. This class of vulnerability allows an attacker to escape the intended directory or service boundary and interact with internal or restricted subsystems. The adjacent-network attack vector (AV:A) indicates the vulnerable management plane or service interface is reachable only from adjacent network segments (LAN, management VLAN, or VPN), not the general internet.
RemediationAI
The primary remediation is to upgrade SonicOS beyond the identified vulnerable version boundaries for each branch: above 6.5.5.1-6n for the 6.x branch, above 7.0.1-5169 for the 7.0.x branch, above 7.3.1-7013 for the 7.3.x branch, and above 8.1.0-8017 for the 8.x branch. Exact patched release versions should be confirmed directly from the SonicWall PSIRT advisory at https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0004, as the input data does not specify released fix versions beyond these boundaries. As a compensating control where immediate patching is not feasible, restrict management interface access to trusted administrative hosts only and ensure the management plane is isolated to a dedicated, access-controlled management VLAN - this directly addresses the AV:A requirement and prevents adjacent untrusted users from reaching the vulnerable service. Disabling unused management protocols (SSH, HTTPS admin access) from non-admin VLANs further reduces attack surface. These controls limit blast radius but do not eliminate the underlying flaw.
SonicWall SonicOS SSLVPN contains an authentication bypass vulnerability allowing remote attackers to bypass authenticat
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (
Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). Rated critical severity (CVSS 9.8), this v
Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. Rated high severity (CVSS 7.5), this vulne
A Host Header Redirection vulnerability in SonicOS potentially allows a remote attacker to redirect firewall management
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially lea
An improper authentication vulnerability has been identified in SonicWall SonicOS SSL-VPN feature, which in specific con
A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially exe
Wind River VxWorks 6.7 though 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 3 of 4). Rated critical seve
Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4). Rated critical severity (CVSS
Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. Rated critical severity (CVSS 9.8), this vul
Same weakness CWE-35 – Path Traversal: '.../...//'
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today