SonicWall SonicOS CVE-2026-0206

Exploitation requires valid high-privilege (administrator-level) SonicOS credentials, as confirmed by PR:H in the CVSS 3.1 vector - unauthenticated exploitation is not possible. The attacker must be able to reach the SonicOS management interface over the network (AV:N, AC:L), meaning exposure is blocked if management access is restricted to internal or out-of-band networks and is exploitable only where the management interface is reachable from untrusted segments or the internet. No user interaction beyond authentication is required (UI:N). Impact is strictly limited to availability - a successful exploit crashes the firewall but yields no code execution, data exfiltration, or persistent access. The requirement for prior acquisition of high-privilege credentials is the dominant limiting factor, confining realistic threat scenarios to insider threats, post-compromise abuse, or sessions established via credential theft.

The CVSS 3.1 base score of 4.9 (Medium) is shaped primarily by PR:H, which restricts the exploitable population to actors possessing valid administrator-level SonicOS credentials. The EPSS score of 0.14% at the 34th percentile is low, consistent with CISA SSVC's 'exploitation: none' classification - both signals align in indicating no observed or anticipated widespread exploitation. SSVC also rates the vulnerability as not automatable, meaning it cannot be trivially scripted at scale, which further suppresses realistic threat volume. Technical impact is classified as partial - availability only, with no confidentiality or integrity loss - making this a firewall-disruption scenario rather than a data breach or persistent compromise vector. The primary real-world concern is targeted disruption: an insider threat or an attacker who has already compromised administrator credentials could deliberately take the firewall offline. This makes the vulnerability relevant in post-breach or insider threat models, but low priority relative to pre-authentication or lower-privilege flaws in the same product.

An attacker who has obtained valid SonicOS administrator credentials - through phishing, credential stuffing using leaked passwords, or lateral movement after compromising an internal admin workstation - authenticates to the SonicOS management interface over the network and submits a crafted request that triggers the stack-based buffer overflow. The overflow corrupts the stack, causing the SonicOS process to crash and taking the perimeter firewall offline, potentially disrupting network connectivity for dependent users and systems. No public proof-of-concept code has been identified at the time of analysis.