SonicWall Patches High-Severity SonicWall NSM On-Prem Access Control and Command Injection Flaws
Do Son 
TL;DR
SonicWall released security updates to fix two high-severity flaws in SonicWall NSM On-Prem deployments. Tracked as CVE-2026-96540 (CVSS 8.8) and CVE-2026-100232 (CVSS 7.2), these SonicWall NSM On-Prem vulnerabilities allow authenticated attackers to escalate privileges or execute arbitrary operating system commands. Therefore, administrators should upgrade on-premises virtual appliances to version 4.4.0 or higher immediately.
- Product: SonicWall Network Security Manager (NSM)
- Vulnerabilities: 2 flaws (CVE-2026-96540, CVE-2026-100232)
- Highest severity: Awaiting analysis
- Status: No confirmed exploitation yet
- Action: See vendor advisories
| CVE | Type | Status |
|---|---|---|
| CVE-2026-96540 | CWE-863 | Not exploited |
| CVE-2026-100232 | CWE-78 | Not exploited |
Why These SonicWall NSM On-Prem Vulnerabilities Matter
Enterprise network administrators use SonicWall Network Security Manager (NSM) to centrally manage firewall policies. They also use it for device configurations, and security logs. Consequently, a compromise of the management server puts downstream firewall infrastructure at severe risk. Furthermore, an attacker could chain the improper access control bug with the high-privileged command injection flaw. This could enable full system control. According to the SonicWall security advisory, “there is currently no evidence any of the vulnerabilities addressed in this release are being exploited in the wild and NSM SaaS versions are not affected by these vulnerabilities.” Similarly, no public proof-of-concept exploit code has been confirmed in the MITRE CVE database.
How the Attacks Work
Improper Access Control in Export Settings (CVE-2026-96540)
Tracked under CWE-863 with a CVSS 3.1 base score of 8.8, CVE-2026-96540 stems from incorrect authorization checks in the configuration export feature. Specifically, SonicWall notes that an improper access control flaw in export settings allows a remote authenticated low-privileged user to obtain sensitive information. Moreover, as the advisory warns, “this may allow the attacker to escalate privileges to an administrator or to intercept communications of other users of the NSM instance.”
Authenticated OS Command Injection (CVE-2026-100232)
Rated 7.2 High on the CVSS 3.1 scale and classified under CWE-78, CVE-2026-100232 is a post-authentication OS command injection flaw in SonicWall NSM On-Prem. The application fails to neutralize special elements inside user-supplied input before passing them to a system shell. Under specific conditions, a remote authenticated attacker with high privileges can inject arbitrary OS commands and achieve remote code execution.
Affected Products and Versions
Based on vendor documentation and published CVE records, only on-premises virtual deployments are impacted:
- Affected: SonicWall Network Security Manager (NSM) On-Prem for VMware, Hyper-V, Azure, and KVM running version 4.3.1 and earlier versions.
- Not Affected: SonicWall NSM SaaS cloud-hosted deployments.
Patch and Mitigation Steps
Because no configuration workarounds exist, “SonicWall strongly advises users of the Network Security Manager (NSM) On-Prem (VMWare, Hyper-V, Azure and KVM) to upgrade to the mentioned fixed release version to address these vulnerabilities.” In addition, administrators must update all SonicWall NSM On-Prem instances to version 4.4.0 or higher right away. They should also restrict management interface access to trusted internal networks.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
