SonicOS EUVD-2026-26254

Exploitation requires adjacent-network access to the SonicOS management interface (CVSS AV:A) and user interaction (UI:R) - meaning an administrator must be induced to act (e.g., visit a crafted link or trigger a request) for the access control gap to be reached. The description explicitly limits this to 'specific conditions' under which 'certain management interface functions' become accessible, so it is not universal against all deployments. Limiting factors: the attacker cannot reach this over the open Internet without being on/routing to the management-adjacent segment, the flaw only exposes particular management functions rather than full unauthenticated admin, and the required user interaction means passive scanning alone will not trigger it. No privileges are required (PR:N), but the adjacency plus interaction requirements meaningfully constrain who can exploit it.

The signals point to a serious-severity but low-urgency issue. CVSS is 8.0 (High) with total technical impact (C:H/I:H/A:H) and PR:N (no privileges required), but three factors constrain real-world risk: AV:A limits the attacker to an adjacent network segment rather than remote Internet reach, UI:R requires user interaction, and AC:L is offset by the need for 'specific conditions' referenced in the description. Corroborating this, EPSS is 0.01% (0th percentile), SSVC records Exploitation: none and Automatable: no, and there is no KEV listing or public POC - so this is not a mass-exploitation candidate. The one tension worth verifying: CVSS marks I:H and A:H yet the tag and description emphasize Information Disclosure (confidentiality), so the integrity/availability impact ratings should be confirmed against the SonicWall advisory. Overall this reads as a real vulnerability to patch on a normal cycle, not an emergency, given the adjacent vector, required user interaction, and absence of exploitation evidence.

An attacker positioned on a network segment adjacent to the appliance's management interface (for example, a compromised host on the management or user LAN) crafts a request or link that, when an authenticated administrator interacts with it, causes restricted management functions to be reached and sensitive configuration or information to be exposed. No public exploit code is identified at time of analysis, and the required user interaction plus adjacent-network positioning raise the practical bar.