Incorrect authorization in SonicWall Network Security Manager - CVE-2026-96540
Published: October 14, 2026
Vulnerability identifier: #VU155796
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-96540
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to obtain sensitive information and potentially escalate privileges to an administrator or intercept other users' communications.
The vulnerability exists due to incorrect authorization in the export settings of SonicWall Network Security Manager (NSM) on-prem when accessing export settings. A remote user can abuse export settings to obtain sensitive information and potentially escalate privileges to an administrator or intercept other users' communications.
Affected software
SonicWall Network Security Manager
How to mitigate CVE-2026-96540
Install security update from vendor's website.
SonicWall Network Security Manager - update to 4.4.0