Introduction
SonicWall firewalls sit at the network perimeter for hundreds of thousands of organizations, and a flaw in their management plane access controls has the potential to hand an adjacent attacker full control over the device without any prior credentials. On April 29, 2026, SonicWall published advisory SNWLID-2026-0004 disclosing CVE-2026-0204, a CVSS 8.0 vulnerability in SonicOS that affects Gen 6, Gen 7, and Gen 8 hardware firewalls, discovered by the CrowdStrike Advanced Research Team.
Technical Information
CVE-2026-0204 is rooted in the SonicOS access control mechanism and is classified under two CWE categories: CWE-306 (Missing Authentication for Critical Function) and CWE-1390 (Weak Authentication). Together, these classifications tell us that certain management interface functions either lack authentication entirely or rely on authentication that can be trivially bypassed under specific conditions.
CVSS Vector Breakdown
The official CVSS 3.1 vector string is:
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Breaking this down:
- Attack Vector (AV:A): The attacker must be on an adjacent network, meaning they need Layer 2 proximity to the target firewall. This rules out direct exploitation from the public internet but leaves the vulnerability exploitable from the same broadcast domain, a guest Wi-Fi segment, a compromised internal host, or any network segment directly connected to the firewall.
- Attack Complexity (AC:L): Exploitation conditions are not complex once the attacker is positioned on the adjacent network.
- Privileges Required (PR:N): No prior authentication or credentials are needed. This is consistent with the CWE-306 classification.
- User Interaction (UI:R): Some form of user interaction is required to trigger the vulnerability. The advisory does not specify what this interaction entails, but possibilities include an administrator accessing the management interface while the attacker is positioned to intercept or inject traffic, or a social engineering component that causes a legitimate user to trigger a specific management function.
- Impact (C:H/I:H/A:H): Successful exploitation yields high impact across all three pillars. On a firewall, this translates to potential exposure of configuration data, VPN credentials, and routing tables (confidentiality); modification of firewall rules, NAT policies, and access controls (integrity); and disruption of network connectivity for all traffic traversing the device (availability).
What We Do Not Know
The vendor advisories are deliberately vague about several key details. They do not disclose which specific management functions are exposed, nor do they describe the exact conditions or user interactions required to trigger the vulnerability. Given the dual CWE classification, the flaw likely involves a management endpoint or set of endpoints that either skip authentication checks entirely or accept a weakened form of authentication under certain runtime conditions. The adjacent network requirement combined with user interaction suggests the attack may involve some form of network level interception or manipulation of management traffic rather than a simple unauthenticated HTTP request.
Attack Flow
Based on the CVSS vector and CWE classifications, a plausible exploitation flow would proceed as follows:
- The attacker gains a position on a network segment adjacent to the SonicWall firewall's management interface. This could be a LAN segment, a VLAN with management access, or a compromised host on the same broadcast domain.
- The attacker identifies the SonicOS management interface (HTTP/HTTPS) and waits for or induces the required user interaction condition.
- Once the specific conditions are met, the attacker accesses management interface functions that would normally require authentication, leveraging the missing or weak authentication controls.
- With access to management functions, the attacker can read sensitive configuration data, modify firewall policies, create new administrative accounts, or disrupt network operations.
Patch Information
SonicWall released patched firmware on April 29, 2026, under advisory SNWLID-2026-0004. The fix is delivered as updated SonicOS firmware across all three active hardware generations. Given the CWE classifications (CWE-306 and CWE-1390), the patch hardens the authentication and access control logic on the SonicOS management interface. This is not a configuration tweak; it requires a full firmware upgrade to the fixed version.
Fixed Firmware Versions
| Platform Generation | Affected Versions | Fixed Version |
|---|---|---|
| Gen 6 Hardware Firewalls (SOHOW, TZ 300/400/500/600 series, NSA 2650 to 6650, SM 9200 to 9650, SOHO 250/250W, TZ 350/350W) | 6.5.5.1-6n and older | 6.5.5.2-28n |
| Gen 7 Firewalls and NSv (TZ270 to TZ670, NSa 2700 to 6700, NSsp 10700 to 15700, NSv 270/470/870 across ESX, KVM, Hyper-V, AWS, Azure) | 7.0.1-5169 and older; 7.3.1-7013 and older | 7.3.2-7010 |
| Gen 8 Firewalls (TZ80, TZ280 to TZ680, NSa 2800 to 5800) | 8.1.0-8017 and older | 8.2.0-8009 |
Gen 6 Downgrade Warning
SonicWall explicitly states that downgrading from 6.5.5.2-28n to any prior firmware version is not supported. A downgrade could delete all LDAP users and reset all MFA settings. If a downgrade becomes necessary for any reason, administrators must manually reconfigure all LDAP users and MFA. SonicWall strongly recommends taking a full configuration backup before upgrading.
Temporary Workarounds
If immediate patching is not feasible, administrators should apply the following mitigations:
- Disable HTTP and HTTPS firewall management on the WAN interface.
- Disable SSL VPN on all interfaces.
- Restrict management access to known IP addresses via SSH.
These workarounds reduce the attack surface but do not fully remediate the underlying vulnerability. Firmware upgrade remains the definitive fix.
Affected Systems and Versions
The vulnerability affects SonicOS across three hardware generations:
Gen 6 Hardware Firewalls:
- All models including SOHOW, TZ 300/400/500/600 series, NSA 2650 through 6650, SM 9200 through 9650, SOHO 250/250W, and TZ 350/350W
- Affected versions: 6.5.5.1-6n and older
Gen 7 Firewalls and NSv:
- All models including TZ270 through TZ670, NSa 2700 through 6700, NSsp 10700 through 15700
- Virtual appliances: NSv 270/470/870 across ESX, KVM, Hyper-V, AWS, and Azure
- Affected versions: 7.0.1-5169 and older; 7.3.1-7013 and older
Gen 8 Firewalls:
- All models including TZ80, TZ280 through TZ680, NSa 2800 through 5800
- Affected versions: 8.1.0-8017 and older
Vendor Security History
SonicWall has a track record of being targeted by sophisticated threat actors, which makes prompt patching of this vulnerability particularly important.
In late 2025, SonicWall concluded an investigation into a breach where a state sponsored threat actor used an API call to access cloud backup firewall configuration files. In response, the company initiated a Secure by Design modernization effort across its product architecture and internal security practices.
Older SonicWall SMA 100 appliances have been heavily targeted by financially motivated groups. UNC6148, for example, utilized previously stolen credentials to establish VPN sessions and deploy backdoors on SMA 100 devices. Additionally, CVE-2021-20035, a previous SonicWall vulnerability, was added to the CISA Known Exploited Vulnerabilities catalog due to confirmed active exploitation in the wild.
While there is no explicit confirmation as of April 29, 2026, that CVE-2026-0204 is being actively exploited, the pattern of threat actor interest in SonicWall edge devices makes this a vulnerability worth treating with urgency. The discovery by CrowdStrike's Advanced Research Team further suggests this flaw was identified through proactive security research rather than incident response, which may mean defenders have a window to patch before exploitation begins.
References
- SonicWall PSIRT Advisory SNWLID-2026-0004
- NVD Entry for CVE-2026-0204
- SonicWall Security Advisory: Firmware Update Required for Gen 6, Gen 7, and Gen 8 Firewalls
- SonicWall Cloud Backup Security Incident Investigation
- SonicWall Wikipedia
- SonicWall SMA100 Ongoing Attacks (Cyberscoop)
- Older SonicWall SMA100 Vulnerability Exploited in the Wild (Cybersecurity Dive)
