CVE-2026-107155 · Infrastructure
NO FIX YET
SonicOS, the operating system on SonicWall firewalls, has a permissive cross-domain policy in its management interface. Under specific conditions a remote unauthenticated attacker could perform unauthorized operations.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running SonicWall firewalls with SonicOS whose management interface can be reached by an attacker are the ones to look at. NVD says it needs 'specific conditions' and user interaction (CVSS UI:R), but no SonicOS versions or conditions have been confirmed from a vendor advisory. Teams without SonicWall appliances, or whose management interface is not reachable from untrusted networks, can likely skip it.
Not affected if management-interface-not-exposed, no-sonicwall-firewall
Who cares firewall, self-hosted, sonicos, sonicwall
No fix yet, per the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.