The seven vulnerabilities are: CVE-2026-107155, a permissive cross-domain policy vulnerability, with a CVSS score of 8.8; CVE-2026-107154, a session validation vulnerability, also with a CVSS score of 8.8; CVE-2026-82308, a pre-authentication heap buffer overflow vulnerability in SSL-VPN, with a CVSS score of 7.5; CVE-2026-19868, an authentication enforcement vulnerability via alternate authentication methods, with a CVSS score of 7.1; CVE-2026-77708, a pre-authentication stack buffer overflow vulnerability in TACACS+, with a CVSS score of 5.9; CVE-2026-77709 , a pre-authentication heap buffer overflow vulnerability in TACACS+, with a CVSS score of also 5.9; and CVE-2026-19703, a weak password hashing hole with a CVSS score of 5.2.
SonicWall only provided a workaround for one of the bugs, CVE-2026-19868; it involves disabling or deleting any active LDAP, RADIUS, and TACACS+ authentication server configured on the firewall.
A ‘mixed bag’
Dickson said the newly reported holes are a mixed bag.
