CVE-2026-19703

MediumCVSS 5.1/10Last modified Nov 6, 2026

Description

A weak password hashing vulnerability has been identified on SonicOS virtual appliances, which in specific conditions could potentially enable an attacker with existing local access to disclose a platform credential. The credential provides access to a limited subset of platform settings.

Metrics

CVSS 3.1 5.1/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-798

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
SonicWall	SonicOS	7.3.3-7015 and older versions; 8.2.2-8015 and older versions

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014

Timeline

Published: Nov 6, 2026
Last modified: Nov 6, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-197045.3The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inj CVE-2026-197068.3During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation. An attacker on the CVE-2026-197085.9The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in CVE-2026-197095.3The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before c CVE-2026-19714.8A vulnerability has been found in Edimax BR-6288ACL up to 1.12. Impacted is the function wiz_WISP24gmanual of the file wiz_WISP24gmanual.asp CVE-2026-197107.3A vulnerability was found in SourceCodester Simple Student Information System. Affected by this vulnerability is an unknown functionality of CVE-2026-197116.5The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balan CVE-2026-197126.1The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants i CVE-2026-197135.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu CVE-2026-197149.1The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauth CVE-2026-197157.5The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is sto CVE-2026-197165.1Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to