SonicWall patches SonicOS flaws that can bypass controls and crash firewalls

SonicWall has released firmware updates for three SonicOS vulnerabilities affecting Gen 6, Gen 7, and Gen 8 firewalls. The flaws can let attackers reach management functions, interact with restricted services, or crash vulnerable firewall devices.

The most serious issue is CVE-2026-0204, an improper access control vulnerability with a CVSS score of 8.0. SonicWall also fixed CVE-2026-0205, a post-authentication path traversal flaw, and CVE-2026-0206, a post-authentication stack-based buffer overflow issue.

Administrators should apply the correct firmware update as soon as possible. SonicWall says the patches are required to maintain a secure firewall posture, especially for devices with exposed management or SSL VPN services.

At a glance

Vulnerability	Type	Severity	Impact
CVE-2026-0204	Improper access control	High, CVSS 8.0	May expose certain management interface functions
CVE-2026-0205	Post-authentication path traversal	Medium, CVSS 6.8	May allow access to usually restricted services
CVE-2026-0206	Post-authentication stack-based buffer overflow	Medium, CVSS 4.9	May allow a remote attacker to crash the firewall

Why the SonicOS update matters

Firewalls protect the edge of a network, so any flaw in their management or remote access features creates serious risk. Attackers who reach a firewall management interface may be able to change settings, weaken protections, or disrupt network security.

CVE-2026-0204 is the main concern because it affects the access control mechanism in SonicOS. Under specific conditions, attackers may reach certain management interface functions that should remain protected.

The other two flaws require authentication, but they still matter. A valid low-level account, stolen credentials, or compromised admin access could make these bugs useful during a larger intrusion.

Affected SonicWall firewall versions

Platform	Affected versions	Fixed version
Gen 6 hardware firewalls	6.5.5.1-6n and earlier	6.5.5.2-28n
Gen 7 firewalls	7.0.1-5169, 7.3.1-7013, and earlier	7.3.2-7010
Gen 7 NSv virtual firewalls	Versions earlier than 7.3.2-7010	7.3.2-7010
Gen 8 firewalls	8.1.0-8017 and earlier	8.2.0-8009

What attackers could do

The first vulnerability can expose SonicOS management functions under certain conditions. That can create a path to unauthorized administrative activity if the management interface remains reachable.

The path traversal flaw can let an authenticated attacker interact with services that SonicOS normally restricts. That may help an attacker move deeper into the firewall environment or reach sensitive internal functions.

The buffer overflow flaw can let a remote authenticated attacker crash a firewall. Even without data theft, a firewall crash can interrupt connectivity, VPN access, and security enforcement for users behind the device.

Recommended actions for administrators

• Upgrade Gen 6 firewalls to SonicOS 6.5.5.2-28n.
• Upgrade Gen 7 firewalls and Gen 7 NSv platforms to SonicOS 7.3.2-7010.
• Upgrade Gen 8 firewalls to SonicOS 8.2.0-8009.
• Prioritize devices with internet-facing management or SSL VPN access.
• Confirm whether Auto Update is enabled and whether the patched firmware has applied successfully.
• Download firmware manually from MySonicWall if Auto Update is disabled.
• Review firewall logs for unusual management access before and after patching.

Temporary workaround if patching must wait

SonicWall recommends a temporary workaround for organizations that cannot patch immediately. Administrators should disable HTTP and HTTPS-based firewall management on all interfaces.

They should also disable SSL VPN on all interfaces until the correct firmware update has been applied. Management access should be restricted to SSH only during this temporary period.

This workaround reduces the exposed attack surface, but it does not replace the firmware update. SonicWall says administrators should still apply the patched firmware as soon as possible.

Important warning for Gen 6 devices

Gen 6 administrators should be careful after installing SonicOS 6.5.5.2-28n. SonicWall warns that downgrading from this patched version to an older firmware version is not supported.

A downgrade can delete LDAP users and reset MFA configuration. That can create avoidable access problems, especially in environments that rely on directory-based authentication and multi-factor authentication.

Before updating Gen 6 devices, administrators should take a full configuration backup. They should also schedule the upgrade during a maintenance window and confirm rollback planning with SonicWall support if needed.

Security teams should review exposure

• Check whether firewall management is reachable from the internet.
• Limit management access to trusted IP addresses where possible.
• Review admin accounts and remove unused users.
• Check logs for failed login attempts, unusual admin sessions, and configuration changes.
• Verify that SSL VPN access follows least-privilege rules.
• Enable MFA for administrative access where supported.
• Document patched firmware versions for compliance and audit teams.

FAQ