SonicWall NSM Bugs Let Attackers Intercept Communications and Execute Commands
SonicWall patched two high-severity NSM On-Prem bugs that can expose data and enable authenticated command execution.
68
CVE-2026-96540
Improper access control in SonicWall NSM on-prem export
- CVSS 3.1
- 8.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-96540 is an improper access control flaw (CWE-863) in the export settings feature of SonicWall Network Security Manager (NSM) on-prem. A remote attacker who is already authenticated with low privileges can abuse that feature over the network without user interaction. Successful exploitation can disclose sensitive information and may let the attacker escalate to administrator or intercept communications of other users of the same NSM instance. Impact is rated high (CVSS 3.1 8.8) with confidentiality, integrity, and availability all high. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Apply SonicWall's fix for on-prem NSM as soon as a patched build is available, and until then limit NSM access to trusted admin networks and accounts. Review who can use export settings, rotate credentials and secrets that may have been exported, and check NSM audit logs for unexpected export activity or privilege changes.
| Product | Affected |
|---|---|
| SonicWall Network Security Manager (NSM) on-prem | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information. This may allow the attacker to escalate privileges to an administrator or to intercept communications of other users of the NSM instance.
- Weakness
- CWE-863
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H