{"id":"CVE-2026-82308","kind":"vulnerability","aliases":["CVE-2026-82308"],"related":[],"title":"SonicWall SonicOS SSL-VPN: pre-auth heap overflow allows remote denial of service","description":"A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS SSL-VPN service, which could potentially enable a remote unauthenticated attacker to cause an application level denial of service.","summary":"A heap-based buffer overflow in the SonicOS SSL-VPN service can be triggered before login. A remote unauthenticated attacker could crash the service and cause an application-level denial of service.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firewall","infrastructure","sonicos","sonicwall","ssl-vpn"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-06T19:17:57+00:00","first_seen_at":"2026-11-06T19:43:49+00:00","triaged_at":"2026-11-06T19:46:03+00:00","updated_at":"2026-11-06T19:46:03+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-06T19:46:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SonicWall SonicOS SSL-VPN: pre-auth heap overflow allows remote denial of service","impact":"low","summary":"A heap-based buffer overflow in the SonicOS SSL-VPN service can be triggered before login. A remote unauthenticated attacker could crash the service and cause an application-level denial of service.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["sonicwall","sonicos","ssl-vpn","firewall"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker crashes the SSL-VPN service, causing denial of service","analyst_note":"Find the SonicWall advisory for CVE-2026-82308 to confirm affected SonicOS versions, fixed releases and whether the SSL-VPN service must be enabled.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running SonicWall firewalls with the SonicOS SSL-VPN service exposed to the network. The sources do not say which SonicOS versions are affected or whether the service must be enabled, so the exposure cannot be confirmed from this entry alone.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000663,"input_tokens":4195,"output_tokens":486,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-82308':18A,21A 'allow':11A 'applic':59B,95C 'application-level':58B 'attack':50B,91C 'auth':8A 'authent':67C 'base':32B,70C 'buffer':33B,71C 'caus':56B,93C 'could':51B,85C 'crash':52B 'cve':16A,19A 'denial':13A,61B,97C 'enabl':87C 'firewal':22B 'heap':9A,31B,69C 'heap-bas':30B,68C 'identifi':76C 'infrastructur':23B 'level':60B,96C 'login':46B 'overflow':10A,34B,72C 'potenti':86C 'pre':7A,66C 'pre-auth':6A 'pre-authent':65C 'remot':12A,48B,89C 'servic':15A,41B,54B,63B,83C,99C 'sonico':2A,24B,37B,79C 'sonicwal':1A,25B 'ssl':4A,27B,39B,81C 'ssl-vpn':3A,26B,38B,80C 'trigger':44B 'unauthent':49B,90C 'vpn':5A,28B,40B,82C 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"Organizations running SonicWall firewalls with the SonicOS SSL-VPN service exposed to the network. The sources do not say which SonicOS versions are affected or whether the service must be enabled, so the exposure cannot be confirmed from this entry alone.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["firewall","infrastructure","sonicos","sonicwall","sslvpn","unknown"],"campaign_type":null,"search_a":"'-2026':17A,20A '-82308':18A,21A 'allow':11A 'auth':8A 'cve':16A,19A 'denial':13A 'heap':9A 'overflow':10A 'pre':7A 'pre-auth':6A 'remot':12A 'servic':15A 'sonico':2A 'sonicwal':1A 'ssl':4A 'ssl-vpn':3A 'vpn':5A","search_b":"'applic':59B 'application-level':58B 'attack':50B 'base':32B 'buffer':33B 'caus':56B 'could':51B 'crash':52B 'denial':61B 'firewal':22B 'heap':31B 'heap-bas':30B 'infrastructur':23B 'level':60B 'login':46B 'overflow':34B 'remot':48B 'servic':41B,54B,63B 'sonico':24B,37B 'sonicwal':25B 'ssl':27B,39B 'ssl-vpn':26B,38B 'trigger':44B 'unauthent':49B 'vpn':28B,40B","search_c":"'applic':95C 'attack':91C 'authent':67C 'base':70C 'buffer':71C 'caus':93C 'could':85C 'denial':97C 'enabl':87C 'heap':69C 'heap-bas':68C 'identifi':76C 'level':96C 'overflow':72C 'potenti':86C 'pre':66C 'pre-authent':65C 'remot':89C 'servic':83C,99C 'sonico':79C 'ssl':81C 'ssl-vpn':80C 'unauthent':90C 'vpn':82C 'vulner':73C","first_public_at":"2026-11-06T19:17:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82308","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82308","severity":null,"published_at":"2026-11-06T19:17:57+00:00","modified_at":"2026-11-06T19:17:57+00:00","first_seen_at":"2026-11-06T19:43:49+00:00","fetched_at":"2026-11-06T19:43:49+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}