CVE-2026-0399
Estado: AnalizadaMedia (4.9)—
Multiple post-authentication stack-based buffer overflow vulnerabilities in the SonicOS management interface due to improper bounds checking in a API endpoint.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 4.9
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.33%
- Percentil entre todas las CVEs puntuadas: 25
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-121
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-0399",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-0399",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-02-24T15:50:04.806000Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 4.9,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "HIGH",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.2
}
]
},
"affected": [
{
"source": "PSIRT@sonicwall.com",
"affectedData": [
{
"vendor": "SonicWall",
"product": "SonicOS",
"versions": [
{
"status": "affected",
"version": "7.0.1-5169 and older versions"
},
{
"status": "affected",
"version": "7.3.1-7013 and older versions"
},
{
"status": "affected",
"version": "8.1.0-8017 and older versions"
}
],
"platforms": [
"Linux",
"Gen7",
"Gen8"
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2026-02-24T15:21:36.980",
"references": [
{
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0001",
"tags": [
"Vendor Advisory"
],
"source": "PSIRT@sonicwall.com"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "PSIRT@sonicwall.com",
"description": [
{
"lang": "en",
"value": "CWE-121"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple post-authentication stack-based buffer overflow vulnerabilities in the SonicOS management interface due to improper bounds checking in a API endpoint."
},
{
"lang": "es",
"value": "Múltiples vulnerabilidades de desbordamiento de búfer basado en pila post-autenticación en la interfaz de gestión de SonicOS debido a una comprobación de límites inadecuada en un endpoint de API."
}
],
"lastModified": "2026-06-17T10:10:44.697",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C263643A-0274-47CF-881F-59CEF6B8A20A",
"versionEndExcluding": "7.3.2-7010"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:sonicwall:nsa_2700:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8D8B0C7A-FD65-47CA-A625-150A90EFA7A1"
},
{
"criteria": "cpe:2.3:h:sonicwall:nsa_3700:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A69E000B-5806-46FD-A233-4E2CC9DD38D2"
},
{
"criteria": "cpe:2.3:h:sonicwall:nsa_4700:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8DF4A322-7CC7-4AB9-B10E-FFF34DF2182D"
},
{
"criteria": "cpe:2.3:h:sonicwall:nsa_5700:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "4C15FED5-C48C-47CF-9645-0563D77883C1"
},
{
"criteria": "cpe:2.3:h:sonicwall:nsa_6700:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A884B1BB-F201-4C77-9F6E-B8A884DCD4C2"
},
{
"criteria": "cpe:2.3:h:sonicwall:nssp_10700:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7C3BA5A3-1160-4793-A8D6-40B9D264BCC4"
},
{
"criteria": "cpe:2.3:h:sonicwall:nssp_11700:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "6739DEA3-06FF-4FEB-9931-0DB27F63B70E"
},
{
"criteria": "cpe:2.3:h:sonicwall:nssp_13700:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "0250EDF9-0AEF-4711-8EF6-D447CF48BCAF"
},
{
"criteria": "cpe:2.3:h:sonicwall:nssp_15700:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7D6CF3CF-256C-4C04-8BDF-B16398CD0459"
},
{
"criteria": "cpe:2.3:h:sonicwall:nsv270:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "DACDCE12-74C2-4F3C-8421-9191700514C5"
},
{
"criteria": "cpe:2.3:h:sonicwall:nsv470:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3AF1ECB1-6257-41E3-A050-6467063F4807"
},
{
"criteria": "cpe:2.3:h:sonicwall:nsv870:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "0883D805-1BA9-49CE-AEC7-51C9D9A69C5C"
},
{
"criteria": "cpe:2.3:h:sonicwall:tz270:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "70340DD4-687B-402C-85AF-C2B80D0F1600"
},
{
"criteria": "cpe:2.3:h:sonicwall:tz270w:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "52847BA2-470B-4078-A79B-52095DB9214B"
},
{
"criteria": "cpe:2.3:h:sonicwall:tz370:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9853AE3A-B0EA-4249-AA7D-1F2051C9BF91"
},
{
"criteria": "cpe:2.3:h:sonicwall:tz370w:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "4DBDD10C-F89D-4051-BC70-67B41167FF9B"
},
{
"criteria": "cpe:2.3:h:sonicwall:tz470:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "6C23940E-2F9D-447B-A740-42035ED5D400"
},
{
"criteria": "cpe:2.3:h:sonicwall:tz470w:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "90C790AD-C40E-4527-8F83-D278282A9600"
},
{
"criteria": "cpe:2.3:h:sonicwall:tz570:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C7DF76E0-8E3D-4E0D-A3BB-F5AE05A4C7C9"
},
{
"criteria": "cpe:2.3:h:sonicwall:tz570p:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "352DFCF9-E333-41C0-8033-91265768FD8E"
},
{
"criteria": "cpe:2.3:h:sonicwall:tz570w:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "4C882C38-9DA5-4C03-BB23-AB2B448E3307"
},
{
"criteria": "cpe:2.3:h:sonicwall:tz670:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "AEEA6065-48D3-4EC7-BD94-CBAE3D1010FF"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C86EC812-9A1A-48A5-B47C-E65B9F49BEE3",
"versionEndExcluding": "8.2.0-8009"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:sonicwall:nsa_2800:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "559FE8B8-E5E1-4E74-98AF-79AF0ECF9064"
},
{
"criteria": "cpe:2.3:h:sonicwall:nsa_3800:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3ED8014A-C7A4-4624-8D50-A9844871C1B6"
},
{
"criteria": "cpe:2.3:h:sonicwall:nsa_4800:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1BDD4AB6-878B-41BE-BA33-6A2ECE2BC85B"
},
{
"criteria": "cpe:2.3:h:sonicwall:nsa_5800:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D28BF416-D019-438B-954E-FB94697DC011"
},
{
"criteria": "cpe:2.3:h:sonicwall:tz280:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "56EC904E-4FCA-4B35-B188-639AE688DD14"
},
{
"criteria": "cpe:2.3:h:sonicwall:tz380:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "83B9556B-0A33-4A27-B9E2-00F47969A566"
},
{
"criteria": "cpe:2.3:h:sonicwall:tz480:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "DCFE3403-6A5B-4735-9248-99297A2E4461"
},
{
"criteria": "cpe:2.3:h:sonicwall:tz580:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "AAEE386F-5FE4-4F21-AD34-33B862AAD1CC"
},
{
"criteria": "cpe:2.3:h:sonicwall:tz680:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "AE6BC579-21A1-4C2F-B655-73B14C3409A7"
},
{
"criteria": "cpe:2.3:h:sonicwall:tz80:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "129CC10F-E822-4BF7-9EB5-0D702020CB0C"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "PSIRT@sonicwall.com"
}