CVE-2026-77709

MediumCVSS 5.9/10Last modified Nov 6, 2026

Description

A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in specific conditions could potentially enable a remote unauthenticated attacker to cause an application level denial of service.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-122

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
SonicWall	SonicOS	7.3.3-7015 and older versions; 8.2.2-8015 and older versions

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014

Timeline

Published: Nov 6, 2026
Last modified: Nov 6, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-77715.5IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a trap when compiling a specially crafted statements containing su CVE-2026-777106.9A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata during import. The CVE-2026-777118.2When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required CVE-2026-777384.3A server-side request forgery vulnerability in the Credential API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080 CVE-2026-77746.9tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later a CVE-2026-77754.8IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway CVE-2026-777518.8A path traversal vulnerability existed in the handling of MISP object template names during STIX 2 import and MISP-to-STIX 2 export. MISP o CVE-2026-777527.2The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network CVE-2026-777535.5The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, CVE-2026-777545.3The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing CVE-2026-777558.7A denial-of-service vulnerability was identified in misp-stix when processing attacker-controlled STIX 1 or STIX 2 documents. The STIX impo CVE-2026-777563.7Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the tra