SonicWall NSM flaws allow command execution and privilege escalation
Two vulnerabilities in SonicWall’s on-premises Network Security Manager enable authenticated attackers to intercept communications and run system commands.
Key points
- CVE-2026-96540 allows low-privilege users to escalate to administrator access.
- CVE-2026-100232 permits high-privilege users to execute arbitrary operating system commands.
- All NSM On-Prem versions through 4.3.1 are vulnerable; version 4.4.0 fixes the issues.
SonicWall disclosed two vulnerabilities in its on-premises Network Security Manager on October 14, 2026. The flaws allow authenticated attackers to escalate privileges and execute commands on the management platform.
The company published advisory SNWLID-2026-0018 to address the issues. The highest Common Vulnerability Scoring System score is 8.8, which is rated as high severity. SonicWall stated it has no evidence of exploitation in the wild.
Technical details of the vulnerabilities
CVE-2026-96540 is an improper access control flaw in the export settings. A remote authenticated attacker with low privileges can exploit this to obtain sensitive information. This could allow them to escalate to administrator status or intercept other users’ communications.
The flaw scores 8.8 on the CVSS v3 scale. It requires no user interaction and only low privileges to exploit. The impact on confidentiality, integrity and availability is rated as high.
CVE-2026-100232 is a post-authentication operating system command injection flaw. A remote authenticated attacker with high privileges can execute arbitrary OS commands. This amounts to remote code execution on the underlying system.
This vulnerability scores 7.2 on the CVSS v3 scale. The high-privilege requirement lowers the score, but the impact remains high. An attacker could chain the two flaws to gain full control.
Affected systems and remediation
The vulnerabilities affect NSM On-Prem deployments on VMware, Hyper-V, Azure and KVM. All versions up to and including 4.3.1 are vulnerable. NSM SaaS deployments are not affected by these flaws.
SonicWall lists no workaround for the issues. Upgrading to version 4.4.0 or later is the only remedy. Administrators should patch quickly because SonicWall products are frequent targets for threat actors.
That suggests organizations should prioritize updating their management platforms to prevent potential lateral movement. As Threat Times reported on October 14, 2026, other security products like Komodo are also facing authentication bypass issues.
What should you do?
Administrators should verify their current NSM On-Prem version immediately. If running version 4.3.1 or earlier, schedule an upgrade to 4.4.0 or later. Monitor logs for unauthorized administrative access or unusual command execution.
What to do and how to stay safe: SonicWall
- Inventory all on-premises NSM instances to confirm version numbers.
- Upgrade to version 4.4.0 or later as soon as maintenance windows allow.
- Review access logs for unauthorized privilege escalation attempts.
- Restrict administrative access to the management console where possible.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of SonicWall NSM are affected by these vulnerabilities?
All on-premises versions up to and including 4.3.1 are vulnerable. NSM SaaS is not affected.
Is there a workaround for these vulnerabilities?
No workaround is listed. Upgrading to version 4.4.0 or later is the only remedy.
Can these vulnerabilities be exploited remotely?
Yes, both vulnerabilities can be exploited remotely by authenticated attackers.
