OS Command Injection in SonicWall Network Security Manager - CVE-2026-100232
Published: October 14, 2026
Vulnerability identifier: #VU155797
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-100232
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to execute arbitrary OS commands, resulting in remote code execution.
The vulnerability exists due to improper neutralization of special elements used in an OS command in SonicWall Network Security Manager (NSM) on-prem when processing OS commands after authentication. A remote privileged user can exploit OS command injection to execute arbitrary OS commands, resulting in remote code execution.
Affected software
SonicWall Network Security Manager
How to mitigate CVE-2026-100232
Install security update from vendor's website.
SonicWall Network Security Manager - update to 4.4.0