SonicWall NSM Bugs Let Attackers Intercept Communications and Execute Commands

SonicWall has disclosed two vulnerabilities in its on-premises Network Security Manager (NSM) that could let authenticated attackers escalate privileges, intercept other users’ communications and run operating system commands.

The company published the advisory, SNWLID-2026-0018, on October 14, 2026. The highest CVSS v3 score is 8.8 (High).

SonicWall NSM vulnerabilities

According to advisory SNWLID-2026-0018 published by SonicWall, NSM is SonicWall’s centralized platform for managing firewalls. A compromised instance could expose policies, credentials and configurations across an entire network estate.

CVE-2026-96540 is an improper access control flaw (CWE-863, Incorrect Authorization) in NSM’s export settings. A remote authenticated attacker could use it to obtain sensitive information.

That could let them escalate to administrator or intercept communications of other users on the same NSM instance. The CVSS score is 8.8, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The attack needs only low privileges and no user interaction.

CVE-2026-100232 is a post-authentication OS command injection flaw (CWE-78). Under specific conditions, a remote authenticated attacker could execute arbitrary OS commands, which amounts to remote code execution.

It scores 7.2, with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The high-privilege requirement lowers the score, but the impact on confidentiality, integrity and availability is still high.

CVE	Type	CWE	CVSS	Privileges
CVE-2026-96540	Improper access control	CWE-863	8.8	Low
CVE-2026-100232	OS command injection	CWE-78	7.2	High

The two flaws could be chained. An attacker with a low-privileged account could abuse CVE-2026-96540 to reach administrator rights. They could then use CVE-2026-100232, which needs high privileges, to run commands on the underlying system.

SonicWall does not describe such a chain, so this is an inference from the two vulnerabilities’ requirements. If it works, it would turn a limited account into full control of the management platform.

The flaws affect NSM On-Prem deployments on VMware, Hyper-V, Azure and KVM. All versions up to and including 4.3.1 are vulnerable. NSM SaaS is not affected.

Product	Affected	Fixed
NSM On-Prem (VMware, Hyper-V, Azure, KVM)	4.3.1 and earlier	4.4.0 and higher

SonicWall lists no workaround, so upgrading to version 4.4.0 or later is the only remedy. The company says it has no evidence of exploitation in the wild. Administrators should still patch quickly, because SonicWall products are frequent targets for threat actors.

Until patching is complete, administrators can reduce risk in these ways, including restricting NSM management access to trusted networks, auditing accounts and removing unnecessary users, reviewing export-setting activity and logs for anomalies, and rotating credentials if suspicious access is found.

Andrei Lungu of Pentest-Tools.com reported CVE-2026-96540 (PTT-2026-025). Andrei Lungu and Matei “Mal” Badanoiu, also of Pentest-Tools.com, reported CVE-2026-100232 (PTT-2026-014).