Three vulnerabilities affecting SonicWall firewalls running firmware versions up to 6.5.5.1-6n, 7.0.1-5169, 7.3.1-7013, and 8.1.0-8017 have been disclosed and patched. The high-severity vulnerability (CVE-2026-0204) enables attackers to bypass access controls and access management interface functions, potentially allowing modification of firewall configurations and disabling security protections. The two medium-severity vulnerabilities include a path traversal weakness (CVE-2026-0205) and a remote crash vulnerability (CVE-2026-0206), both requiring authentication. SonicWall released firmware updates 6.5.5.2-28n, 7.3.2-7010, and 8.2.0-8009 to remediate these issues and recommends restricting management access to SSH only as a temporary mitigation.

Successful exploitation of the high-severity vulnerability could allow attackers to bypass firewall access controls and gain unauthorized access to management interface functions, potentially leading to configuration changes and disabling of security protections. The medium-severity vulnerabilities could allow authenticated attackers to interact with restricted services via path traversal or cause denial-of-service by crashing the firewall. These impacts could degrade firewall security and availability.

SonicWall has released official firmware updates that fix these vulnerabilities. Customers should immediately apply the patched firmware versions 6.5.5.2-28n, 7.3.2-7010, or 8.2.0-8009 depending on their device. Until patching is possible, SonicWall recommends restricting management access to SSH only by disabling HTTP/HTTPS-based management and SSLVPN on all interfaces. These access restrictions are temporary mitigations and should be replaced by applying the official patches as soon as possible.