SB2026101494 - Multiple vulnerabilities in SonicWall Network Security Manager
Published: October 14, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Incorrect authorization (CVE-ID: CVE-2026-96540)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to obtain sensitive information and potentially escalate privileges to an administrator or intercept other users' communications.
The vulnerability exists due to incorrect authorization in the export settings of SonicWall Network Security Manager (NSM) on-prem when accessing export settings. A remote user can abuse export settings to obtain sensitive information and potentially escalate privileges to an administrator or intercept other users' communications.
2) OS Command Injection (CVE-ID: CVE-2026-100232)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to execute arbitrary OS commands, resulting in remote code execution.
The vulnerability exists due to improper neutralization of special elements used in an OS command in SonicWall Network Security Manager (NSM) on-prem when processing OS commands after authentication. A remote privileged user can exploit OS command injection to execute arbitrary OS commands, resulting in remote code execution.
Remediation
Install update from vendor's website.