Do Son 
SonicWall released a security bulletin detailing three security flaws in on-premise management appliances. These SonicWall NSM vulnerabilities allow attackers to bypass authorization controls and execute arbitrary system commands. However, the vendor confirmed that no public exploits currently exist in the wild.
Why It Matters
These flaws pose critical operational risks to enterprise perimeter management. Consequently, attackers could combine these weaknesses to achieve total control over the host server. A lower-privileged administrator can elevate privileges directly to SuperAdmin level. As a result, rogue actors could alter network firewall policies or disable logging mechanisms.
How the Attack Works
The security advisory identifies three separate flaw mechanisms across the management software. First, CVE-2026-78328 involves missing authorization within the web management interface. An attacker uses this authorization gap to elevate an administrative account to SuperAdmin status.
Next, CVE-2026-78327 allows OS command injection on the underlying server. The advisory notes that “an Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the underlying host, resulting in remote code execution.”
Additionally, CVE-2026-81939 represents a classic Zip Slip path traversal vulnerability. An attacker can extract malicious archive files outside the intended destination directory.
Affected Versions
These SonicWall NSM vulnerabilities affect on-premise deployments running version 4.3.0 and earlier. The flaw impacts virtual appliances on VMware, Hyper-V, Azure, and KVM hypervisors. In contrast, SonicWall confirmed that cloud-hosted NSM SaaS versions remain unaffected.
Patch and Mitigation Steps
SonicWall released version 4.3.1-R4 to resolve these critical SonicWall NSM vulnerabilities. Currently, the vendor provides no temporary workarounds for vulnerable deployments. Therefore, security teams must apply official software updates immediately.
Organizations can consult the SonicWall security advisory SNWLID-2026-0015 for deployment details. The advisory confirms that “there is currently no evidence any of the vulnerabilities addressed in this release are being exploited in the wild.”
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
