{"id":"CVE-2026-77709","kind":"vulnerability","aliases":["CVE-2026-77709"],"related":[],"title":"SonicWall SonicOS: TACACS+ heap overflow enables remote denial of service","description":"A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in specific conditions could potentially enable a remote unauthenticated attacker to cause an application level denial of service.","summary":"A heap-based buffer overflow in the SonicOS TACACS+ authentication client can be triggered before login. In specific conditions, a remote unauthenticated attacker can crash an application and cause a denial of service.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firewall","infrastructure","sonicos","sonicwall","tacacs+"],"not_affected_if":["no-tacacs-auth"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-06T19:17:57+00:00","first_seen_at":"2026-11-06T19:43:49+00:00","triaged_at":"2026-11-06T19:46:04+00:00","updated_at":"2026-11-06T19:46:04+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-06T19:46:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SonicWall SonicOS: TACACS+ heap overflow enables remote denial of service","impact":"low","summary":"A heap-based buffer overflow in the SonicOS TACACS+ authentication client can be triggered before login. In specific conditions, a remote unauthenticated attacker can crash an application and cause a denial of service.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["sonicos","sonicwall","tacacs+","firewall"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote unauthenticated attacker causes application-level denial of service","analyst_note":"Check SonicWall's advisory for affected SonicOS versions, the specific TACACS+ conditions, and the fixed release.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-tacacs-auth"],"who_is_affected":"Organizations running SonicWall firewalls with SonicOS that use TACACS+ for administrator authentication. The sources do not state which configurations trigger the specific conditions, so whether a given deployment is exposed is unknown. Teams not using SonicOS or TACACS+ can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000659,"input_tokens":4199,"output_tokens":478,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-77709':13A,16A 'applic':49B,89C 'attack':45B,85C 'authent':32B,59C,73C 'base':25B,62C 'buffer':26B,63C 'caus':51B,87C 'client':33B,74C 'condit':41B,78C 'could':79C 'crash':47B 'cve':11A,14A 'denial':8A,53B,91C 'enabl':6A,81C 'firewal':17B 'heap':4A,24B,61C 'heap-bas':23B,60C 'identifi':68C 'infrastructur':18B 'level':90C 'login':38B 'overflow':5A,27B,64C 'potenti':80C 'pre':58C 'pre-authent':57C 'remot':7A,43B,83C 'servic':10A,55B,93C 'sonico':2A,19B,30B,71C 'sonicwal':1A,20B 'specif':40B,77C 'tacac':3A,21B,31B,72C 'trigger':36B 'unauthent':44B,84C 'vulner':65C","nicknames":[],"mitigations":[],"who_affected":"Organizations running SonicWall firewalls with SonicOS that use TACACS+ for administrator authentication. The sources do not state which configurations trigger the specific conditions, so whether a given deployment is exposed is unknown. Teams not using SonicOS or TACACS+ can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["firewall","infrastructure","sonicos","sonicwall","tacacs","unknown"],"campaign_type":null,"search_a":"'-2026':12A,15A '-77709':13A,16A 'cve':11A,14A 'denial':8A 'enabl':6A 'heap':4A 'overflow':5A 'remot':7A 'servic':10A 'sonico':2A 'sonicwal':1A 'tacac':3A","search_b":"'applic':49B 'attack':45B 'authent':32B 'base':25B 'buffer':26B 'caus':51B 'client':33B 'condit':41B 'crash':47B 'denial':53B 'firewal':17B 'heap':24B 'heap-bas':23B 'infrastructur':18B 'login':38B 'overflow':27B 'remot':43B 'servic':55B 'sonico':19B,30B 'sonicwal':20B 'specif':40B 'tacac':21B,31B 'trigger':36B 'unauthent':44B","search_c":"'applic':89C 'attack':85C 'authent':59C,73C 'base':62C 'buffer':63C 'caus':87C 'client':74C 'condit':78C 'could':79C 'denial':91C 'enabl':81C 'heap':61C 'heap-bas':60C 'identifi':68C 'level':90C 'overflow':64C 'potenti':80C 'pre':58C 'pre-authent':57C 'remot':83C 'servic':93C 'sonico':71C 'specif':77C 'tacac':72C 'unauthent':84C 'vulner':65C","first_public_at":"2026-11-06T19:17:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77709","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77709","severity":null,"published_at":"2026-11-06T19:17:57+00:00","modified_at":"2026-11-06T19:17:57+00:00","first_seen_at":"2026-11-06T19:43:49+00:00","fetched_at":"2026-11-06T19:43:49+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}