EUVD-2026-71679
GHSA-vp6r-xqwr-m9qg
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-reachable management interface (AV:N) with no user interaction, but requires top-tier SuperAdmin (PR:H); command injection escapes app authority to host OS (S:C) yielding full C/I/A.
Primary rating from Vendor (sonicwall).
CVSS VectorVendor: sonicwall
Lifecycle Timeline
4DescriptionCVE.org
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the underlying host, resulting in remote code execution.
AnalysisAI
Remote code execution in SonicWall Network Security Manager (NSM) On-Prem 4.3.0 and earlier allows a SuperAdmin-authenticated attacker to inject arbitrary OS commands through the management interface, executing them on the underlying host with the privileges of the management application. Because exploitation requires the highest-tier SuperAdmin role (CVSS PR:H), the real-world attack surface is narrower than the 9.1 score alone suggests. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated session at the SuperAdmin privilege level on a SonicWall NSM On-Prem instance running version 4.3.0 or earlier; the attacker must reach the management interface over the network (AV:N) but no user interaction is needed (UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1) marks this as critical-severity, but the single most important signal is PR:H - exploitation requires an already-authenticated SuperAdmin, the highest privilege in NSM. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade SonicWall NSM On-Prem to a fixed release above 4.3.0 as directed in SonicWall advisory SNWLID-2026-0015 (https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0015); the input does not enumerate an exact fixed build, so confirm the precise patched version from the advisory before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all NSM On-Prem deployments running version 4.3.0 or earlier and immediately restrict management interface access to trusted administration networks via firewall rules; audit SuperAdmin account activity for unauthorized access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Network Security Manager Nsm
View allArbitrary file write via Zip Slip in SonicWall Network Security Manager (NSM) On-Prem (versions 4.3.0 and earlier) allow
The analysis is complete. Key points of my synthesis: - **Vulnerability**: CWE-862 missing authorization in SonicWall N
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today