CVE-2026-0401A post-authentication NULL Pointer Dereference vulnerability in SonicOS allows a remote attacker to crash a firewall.

4.9MediumCVSS base score
0.40%Exploitation in 30 daysEPSS · top 66% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
NonePublic exploitsnone known yet

Description

A post-authentication NULL Pointer Dereference vulnerability in SonicOS allows a remote attacker to crash a firewall.

Timeline

2025
2 Dec 2025
2 Dec 2025
ID reserved
By sonicwall
2026
24 Feb 20263 months later
24 Feb 2026· 3 months later
Published

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-0401, by who scored it
Scored by	CVSS	Score	Vector
CISA-ADPADP (enrichment)	3.1	Medium4.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
NVDNVD · Analyzed	3.1	Medium4.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

EPSS (exploitation in 30 days): 0.40% · top 66% of all CVEs (12 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.9.

Affected products

SonicWall · SonicOS
- affected 7.0.1-5169 and older versions
- affected 7.3.1-7013 and older versions
- affected 8.1.0-8017 and older versions

References1

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0001 (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-0401](https://cveledger.app/badge/CVE-2026-0401.svg)](https://cveledger.app/cve/CVE-2026-0401)

Record last updated 24 Feb 2026, 15:34 UTC.