CVE-2026-19703 · Infrastructure
NO FIX YET
SonicOS virtual appliances use a weak password hash that, under specific conditions, can be exploited by an attacker who already has local access to disclose a platform credential. That credential grants access to a limited subset of platform settings.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running SonicWall SonicOS virtual appliances (virtual firewalls) in the specific conditions the advisory describes, which the sources do not spell out. Exposure requires an attacker with existing local access, so appliances without untrusted local users are less exposed. unknown for the exact configuration.
Not affected if no-local-access-risk
Who cares firewall, sonicos, sonicwall, virtual-appliance
Unknown from the sources.
No fix yet, per the sources.
A weak password hashing vulnerability has been identified on SonicOS virtual appliances, which in specific conditions could potentially enable an attacker with existing local access to disclose a platform credential. The credential provides access to a limited subset of platform settings.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.