---
id: "CVE-2026-107154"
page: "https://infrastack.ai/live/CVE-2026-107154"
kind: "vulnerability"
aliases: ["CVE-2026-107154"]
title: "SonicWall SonicOS: session validation flaw lets unauthenticated remote attackers act"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["firewall", "infrastructure", "self-hosted", "sonicos", "sonicwall"]
not_affected_if: ["management-interface-not-exposed"]
published_at: "2026-11-06T19:17:06+00:00"
first_seen_at: "2026-11-06T19:43:48+00:00"
updated_at: "2026-11-06T19:47:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107154", "first_seen_at": "2026-11-06T19:43:48+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107154", "first_seen_at": "2026-11-06T19:47:59+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-107154"]}]
exploit_sources: []
---

# SonicWall SonicOS: session validation flaw lets unauthenticated remote attackers act

Link for people: https://infrastack.ai/live/CVE-2026-107154 (this .md is for agents)

A session validation flaw in the SonicOS management interface can, under specific conditions, let a remote attacker without credentials perform unauthorized operations. The sources do not say which operations or which SonicOS versions are affected.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Record each SonicWall firewall's SonicOS version (management console, System > Status)
- Check whether the management interface (HTTPS) is reachable from the internet or untrusted networks; restrict it to a trusted network
- Watch the SonicWall PSIRT portal for the advisory covering CVE-2026-107154 to get affected and fixed versions; they are not yet known

## Timeline

- 2026-11-06T19:43:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107154
- 2026-11-06T19:47:59+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-107154 — No SonicWall PSIRT advisory (SNWLID) found for this CVE in search as of publication; PSIRT portal is JS/reCAPTCHA-gated. NVD only: no versions, fix, or conditions. NVD CVSS vector is AV:N/PR:N/UI:R (user interaction required), so 'unauthenticated' may still need a user action. Nothing verified. Recheck PSIRT psirt.global.sonicwall.com for the SNWLID once published.

## Documents

- [describes] NVD: CVE-2026-107154 https://nvd.nist.gov/vuln/detail/CVE-2026-107154

## From the sources

A session validation vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_