Medium

Post-authentication Path Traversal in SonicOS

IdentifiersCVE-2026-0205CWE-22

CVE-2026-0205 is a post-authentication path traversal vulnerability in SonicOS affecting SonicWall Generation 6, Generation 7, and Generation 8 firewall platforms, including hardware and virtual firewall products. According to the provided reporting and extracted facts, a successfully authenticated attacker can exploit the flaw to interact with services that are normally restricted. The vulnerable condition is described only at a high level in the available content; no specific endpoint, function, or code path is identified.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an authenticated attacker to reach or interact with services that are ordinarily restricted by the appliance. This can weaken intended service isolation and security boundaries on the firewall management plane or related internal services. Based on the available information, the primary impact is unauthorized access to restricted services; no direct evidence is provided here for code execution or full device compromise from this CVE alone.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, SonicWall recommended disabling HTTP- and HTTPS-based firewall management on all interfaces, disabling SSLVPN on all interfaces, and restricting management access to SSH only until updates are applied. Additional hardening guidance in the provided content includes disabling HTTP/HTTPS management from untrusted networks, restricting SSL VPN exposure where possible, resetting local and migrated VPN credentials, auditing LDAP and service accounts, and monitoring for VPN logins originating from VPS and hosting providers.

Remediation

Patch, then assume compromise.

Apply SonicWall’s fixed SonicOS firmware versions for affected platforms. The provided content states that patched versions include 6.5.5.2-28n for Generation 6, 7.3.2-7010 for Generation 7, and 8.2.0-8009 for Generation 8. Affected versions include firmware up to 6.5.5.1-6n, 7.0.1-5169, 7.3.1-7013, and 8.1.0-8017. SonicWall also advised administrators to perform a full configuration backup before upgrading. For Generation 6 devices, the content warns not to downgrade from 6.5.5.2-28n because doing so deletes LDAP users and resets MFA configuration.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

SonicwallSonicosoperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

7 SOURCESView more in app

scworldNews

May 1, 2026

SonicWall releases firmware updates for three CVEs | news | SC Media

A medium-severity SonicWall SonicOS vulnerability affecting Gen 6, Gen 7, and Gen 8 firewall platforms.

security affairsNews

May 1, 2026

SonicWall patches three SonicOS flaws in Gen 6, 7 and 8 firewalls. Patch them now

A post-authentication path traversal vulnerability in SonicOS that could allow an attacker to interact with normally restricted services.

cyber security newsNews

Apr 30, 2026

SonicWall SonicOS Vulnerabilities Allow Attackers to Bypass Access Controls and Crash Firewall

A post-authentication path traversal vulnerability in SonicWall SonicOS that enables access to services that are normally restricted.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity4