SonicWall has reported vulnerabilities in its SonicOS platforms. CVE-2026-19868 is actively exploited.
OffSet7 Newsroom · Reviewed by an OffSet7 analyst · AI-assisted
What happened
Vulnerabilities reported in SonicOS.
Who is affected
SonicOS Gen7 < 7.3.3-7015, Gen8 < 8.2.2-8015.
Exploited
CVE-2026-19868 is actively exploited.
What to do
Apply patches and review security advisories.
SonicWall has identified seven vulnerabilities in its SonicOS platforms. These vulnerabilities affect Gen7 versions prior to 7.3.3-7015 and Gen8 versions prior to 8.2.2-8015. The vulnerabilities include server-side request forgery and buffer overflows, potentially enabling unauthorized access and denial of service.
CVE-2026-19868, one of the vulnerabilities in SonicOS, is actively exploited and has been added to the Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog.
CVE-2026-95778 has been disclosed for HPE Morpheus Software, allowing for remote code execution and has been assigned a CVSS score of 8.8.
Organizations are advised to apply patches and review security advisories to mitigate the risks associated with these vulnerabilities.
www.cve.org: Status Published CVE-2026-107155 A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.
www.cve.org: Status Published CVE-2026-107154 A session validation vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.
www.cve.org: Status Published CVE-2026-82308 A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS SSL-VPN service, which could potentially enable a remote unauthenticated attacker to cause an application level denial of service.
Is your company exposed to this?
Check your domain for free against leaked logins, infected devices and exposed systems.
