SonicWall NSM Bugs Let Attackers Intercept Communications and Execute Commands
SonicWall patched two high-severity NSM On-Prem bugs that can expose data and enable authenticated command execution.
SonicWall advisory SNWLID-2026-0018 discloses two authenticated flaws in on-premises Network Security Manager, with a highest CVSS score of 8.8. CVE-2026-96540 can let a low-privileged remote user obtain sensitive data, escalate toward administrator, or intercept other users’ communications. CVE-2026-100232 can let a high-privileged user execute OS commands. Versions through 4.3.1 on VMware, Hyper-V, Azure, and KVM are affected; NSM SaaS is not, and 4.4.0 fixes both. SonicWall says it has no evidence of in-the-wild exploitation.
- CVE-2026-96540 is improper authorization in export settings, CVSS 8.8, low privileges.
- CVE-2026-100232 is post-auth OS command injection, CVSS 7.2, high privileges required.
- On-prem NSM through 4.3.1 is affected; SaaS is not; fix is 4.4.0 or later.
- SonicWall reports no evidence of exploitation and lists no workaround.
- Vendors
- SonicWall
- Products
- SonicWall NSM On-Prem
- Organizations
- Pentest-Tools.com
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-96540+1 related CVE | Improper access control in SonicWall NSM on-prem export | 8.8 group max | — |
From the original article
2 min read at gbhackers.com
SonicWall has disclosed two vulnerabilities in its on-premises Network Security Manager (NSM) that could let authenticated attackers escalate privileges, intercept other users’ communications and run operating system commands. The company published the advisory, SNWLID-2026-0018, on October 14, 2026. The highest CVSS v3 score is 8.
By Kavichselvan · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.