{"id":"CVE-2026-107155","kind":"vulnerability","aliases":["CVE-2026-107155"],"related":[],"title":"SonicWall SonicOS: permissive cross-domain policy lets remote attackers act unauthenticated","description":"A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.","summary":"SonicOS, the operating system on SonicWall firewalls, has a permissive cross-domain policy in its management interface. Under specific conditions a remote unauthenticated attacker could perform unauthorized operations.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firewall","infrastructure","self-hosted","sonicos","sonicwall"],"not_affected_if":["management-interface-not-exposed","no-sonicwall-firewall"],"how_to_check":"Unknown: SonicWall has not published an advisory I could read. Check psirt.global.sonicwall.com for the SNWLID covering CVE-2026-107155, then compare your SonicOS version (System > Status) with its affected list. Until then, check whether the firewall's management interface (HTTPS admin) is reachable from the internet.","fix":null,"status":"open","published_at":"2026-11-06T19:17:06+00:00","first_seen_at":"2026-11-06T19:43:48+00:00","triaged_at":"2026-11-06T19:45:46+00:00","updated_at":"2026-11-06T19:48:21+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-06T19:45:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SonicWall SonicOS: permissive cross-domain policy lets remote attackers act unauthenticated","impact":"high","summary":"SonicOS, the operating system on SonicWall firewalls, has a permissive cross-domain policy in its management interface. Under specific conditions a remote unauthenticated attacker could perform unauthorized operations.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["sonicwall","sonicos","firewall","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"remote attacker performs unauthorized management operations without logging in","analyst_note":"Find the SonicWall advisory and the affected SonicOS versions and fixed release for this CVE, and confirm the specific conditions that make it exploitable.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-sonicwall-firewall","management-interface-not-exposed"],"who_is_affected":"Organisations running SonicWall firewalls with SonicOS and an exposed management interface are the ones at risk. The sources do not say which SonicOS versions or which specific conditions are required. Teams not running SonicWall appliances can skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000663,"input_tokens":4188,"output_tokens":489,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the SonicWall advisory and the affected SonicOS versions and fixed release for this CVE, and confirm the specific conditions that make it exploitable.","search":"'-107155':15A,18A '-2026':14A,17A 'act':11A 'attack':10A,50B,80C 'condit':46B,73C 'could':51B,74C 'cross':5A,37B,58C 'cross-domain':4A,36B,57C 'cve':13A,16A 'domain':6A,38B,59C 'enabl':76C 'firewal':19B,32B 'host':23B 'identifi':64C 'infrastructur':20B 'interfac':43B,69C 'let':8A 'manag':42B,68C 'oper':28B,54B,84C 'perform':52B,82C 'permiss':3A,35B,56C 'polici':7A,39B,60C 'potenti':75C 'remot':9A,48B,78C 'self':22B 'self-host':21B 'sonico':2A,24B,26B,67C 'sonicwal':1A,25B,31B 'specif':45B,72C 'system':29B 'unauthent':12A,49B,79C 'unauthor':53B,83C 'vulner':61C","nicknames":[],"mitigations":[],"who_affected":"Teams running SonicWall firewalls with SonicOS whose management interface can be reached by an attacker are the ones to look at. NVD says it needs 'specific conditions' and user interaction (CVSS UI:R), but no SonicOS versions or conditions have been confirmed from a vendor advisory. Teams without SonicWall appliances, or whose management interface is not reachable from untrusted networks, can likely skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["firewall","high","infrastructure","selfhosted","sonicos","sonicwall"],"campaign_type":null,"search_a":"'-107155':15A,18A '-2026':14A,17A 'act':11A 'attack':10A 'cross':5A 'cross-domain':4A 'cve':13A,16A 'domain':6A 'let':8A 'permiss':3A 'polici':7A 'remot':9A 'sonico':2A 'sonicwal':1A 'unauthent':12A","search_b":"'attack':50B 'condit':46B 'could':51B 'cross':37B 'cross-domain':36B 'domain':38B 'firewal':19B,32B 'host':23B 'infrastructur':20B 'interfac':43B 'manag':42B 'oper':28B,54B 'perform':52B 'permiss':35B 'polici':39B 'remot':48B 'self':22B 'self-host':21B 'sonico':24B,26B 'sonicwal':25B,31B 'specif':45B 'system':29B 'unauthent':49B 'unauthor':53B","search_c":"'attack':80C 'condit':73C 'could':74C 'cross':58C 'cross-domain':57C 'domain':59C 'enabl':76C 'identifi':64C 'interfac':69C 'manag':68C 'oper':84C 'perform':82C 'permiss':56C 'polici':60C 'potenti':75C 'remot':78C 'sonico':67C 'specif':72C 'unauthent':79C 'unauthor':83C 'vulner':61C","first_public_at":"2026-11-06T19:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107155","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107155","severity":null,"published_at":"2026-11-06T19:17:06+00:00","modified_at":"2026-11-06T19:17:06+00:00","first_seen_at":"2026-11-06T19:43:48+00:00","fetched_at":"2026-11-06T19:43:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107155:1926","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107155","severity":null,"published_at":"2026-11-06T19:48:21+00:00","modified_at":"2026-11-06T19:48:21+00:00","first_seen_at":"2026-11-06T19:48:21+00:00","fetched_at":"2026-11-06T19:48:21+00:00","note":"Only NVD found (linked). SonicWall PSIRT advisory for this CVE not indexed/readable (PSIRT portal is JS/reCAPTCHA gated); no affected versions, fix, or conditions confirmed. Nothing verified. Sibling CVE-2026-107154 published same time, likely same advisory. Revisit when SNWLID appears. Note: CVSS vector has UI:R, which the earlier summary omitted. No exploitation or PoC found.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-107155"]}],"documents":[{"id":89373,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107155","title":"NVD: CVE-2026-107155","kind":"other","source":"analyst","publisher":null,"text":"A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations. CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8)","published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}