EUVD-2026-71679
GHSA-vp6r-xqwr-m9qg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain SuperAdmin access to NSM On-Prem
-
DeliverySubmit crafted input to management interface
-
ExploitBreak out via unsanitized OS command
-
ExecutionExecute arbitrary commands on host
-
ImpactPivot to control managed firewalls
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated session at the SuperAdmin privilege level on a SonicWall NSM On-Prem instance running version 4.3.0 or earlier; the attacker must reach the management interface over the network (AV:N) but no user interaction is needed (UI:N). The decisive limiting factor is the SuperAdmin requirement (CVSS PR:H) - a standard admin or lower-tier operator cannot exploit it, so the flaw is not usable by anonymous or low-privilege attackers and depends on prior compromise or possession of top-tier management credentials. |
| Impact | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1) marks this as critical-severity, but the single most important signal is PR:H - exploitation requires an already-authenticated SuperAdmin, the highest privilege in NSM. That is a strong limiting factor: an attacker who holds SuperAdmin already controls the managed security fabric, so this vulnerability primarily represents a privilege-to-host-OS escalation (management-plane compromise turning into full OS RCE) rather than an anonymous remote takeover. No EPSS score, KEV entry, or POC is present in the provided data, so there is no evidence of active or automatable exploitation. Net: worth prompt patching in defense-in-depth terms, but it is not a mass-exploitable pre-auth bug and ranks below unauthenticated RCEs on the same platform. No conflicting signals were found in the input; the only caveat is that the S:C scope judgment and 9.1 magnitude hinge on the management-app-to-host escalation being counted as a scope change. |
| Exploit ScenarioDerived | An attacker who has obtained SuperAdmin credentials (via phishing, credential reuse, or an insider) logs into the NSM On-Prem management interface and submits a crafted value containing shell metacharacters into a vulnerable field; the backend concatenates it into a system command, and the injected payload executes on the host OS. The attacker gains code execution on the management server, from which they can pivot to control every firewall NSM manages. No public POC is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 04, 2026
Remote code execution in SonicWall Network Security Manager (NSM) On-Prem 4.3.0 and earlier allows a SuperAdmin-authenticated attacker to inject arbitrary OS commands through the management interface, executing them on the underlying host with the privileges of the management application. Because exploitation requires the highest-tier SuperAdmin role (CVSS PR:H), the real-world attack surface is narrower than the 9.1 score alone suggests. There is no public exploit identified at time of analysis and no KEV listing.
RemediationAI
Upgrade SonicWall NSM On-Prem to a fixed release above 4.3.0 as directed in SonicWall advisory SNWLID-2026-0015 (https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0015); the input does not enumerate an exact fixed build, so confirm the precise patched version from the advisory before deploying. Until patched, reduce exposure by strictly limiting who holds the SuperAdmin role (this vulnerability is only reachable by that role), enforcing MFA and rotating SuperAdmin credentials, and restricting network reachability of the NSM management interface to a dedicated management VLAN or jump-host allowlist so the interface is not broadly reachable - the trade-off is added operational friction for legitimate administrators. Also audit NSM host and application logs for unexpected command execution or new processes spawned by the management service. Do not rely on WAF/input filtering as a primary control given command-injection bypass variety.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SonicWall NSM On-Prem is a centralized management platform used to configure, monitor, and orchestrate fleets of SonicWall firewalls. The flaw is a CWE-78 OS Command Injection: a management-interface field or API parameter is passed to an underlying shell/system call without proper neutralization of shell metacharacters, so attacker-supplied input is interpreted as command syntax rather than data. The affected CPE is cpe:2.3:a:sonicwall:network_security_manager_(nsm), covering the on-prem software rather than SonicWall's cloud-hosted NSM. The CVSS scope-changed vector (S:C) reflects that a compromise of the management application authority propagates into full control of the host operating system.
Know when Network Security Manager Nsm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-reachable management interface (AV:N) with no user interaction, but requires top-tier SuperAdmin (PR:H); command injection escapes app authority to host OS (S:C) yielding full C/I/A.
Primary rating from Vendor (sonicwall).
CVSS VectorVendor: sonicwall
Lifecycle Timeline
3DescriptionCVE.org
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the underlying host, resulting in remote code execution.
Executive ViewAI
SonicWall Network Security Manager (NSM) On-Prem versions 4.3.0 and earlier contain a critical remote code execution vulnerability in the management interface. While exploitation requires SuperAdmin authentication, compromise of an administrative account would allow attackers to execute arbitrary commands on the NSM infrastructure with full application privileges, potentially disabling security controls, exfiltrating configurations, or pivoting to protected networks.
Until vendor patch is available: (1) restrict NSM management interface access via firewall to authorized administration networks only; (2) enforce multi-factor authentication on all SuperAdmin accounts; (3) implement comprehensive audit logging of management interface and process execution; (4) deploy host-based monitoring to detect unauthorized command execution; (5) implement network segmentation to contain potential NSM compromise; (6) maintain offline configuration backups; (7) establish incident response procedures for potential administrative account compromise.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Network Security Manager Nsm
View allArbitrary file write via Zip Slip in SonicWall Network Security Manager (NSM) On-Prem (versions 4.3.0 and earlier) allow
The analysis is complete. Key points of my synthesis: - **Vulnerability**: CWE-862 missing authorization in SonicWall N
Improper access control in the export settings feature of SonicWall Network Security Manager (NSM) on-prem let a remote
Authenticated attackers with high privileges on SonicWall Network Security Manager (NSM) on-prem can execute arbitrary O
Exploit-DB