CVE-2026-107155

DiscoveredNov 6, 2026UpdatedNov 7, 2026

A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.

View graph Watch Export

CVSS v3.1

8.8 HIGH

EPSS

0.75%

probability of exploitation in 30 days

CISA KEV

Not listed

no confirmed exploitation reported

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityLOW

Privileges RequiredNONE

User InteractionREQUIRED

ScopeUNCHANGED

ConfidentialityHIGH

IntegrityHIGH

AvailabilityHIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Connections

3 relationships

CWE-942

source

Timeline

disclosure → media coverage

Nov 6, 2026

Disclosure — published as a CVE record.

Nov 9, 2026

thehackernews.com reports: CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible Exploitation

Nov 9, 2026

advisories.ncsc.nl reports: NCSC-2026-0471 [1.00] [M/H] Kwetsbaarheden verholpen in SonicOS van SonicWall