HTTP Header Injection in SonicOS Allows Host Header Manipulation
CVE-2026-0516 Published on August 5, 2026

A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the Host header and redirect firewall management users to arbitrary web domains.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-0516 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
LOW
Integrity Impact:
LOW
Availability Impact:
NONE

Weakness Type

Improper Neutralization of HTTP Headers for Scripting Syntax

The application does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.


Products Associated with CVE-2026-0516

Want to know whenever a new CVE is published for SonicWall Sonicos? stack.watch will email you.

SonicWall Sonicos
 

Affected Versions

SonicWall SonicOS: