What is the CVSS score of CVE-2026-78328?

CVE-2026-78328 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Network Security Manager Nsm are affected by CVE-2026-78328?

SonicWall NSM On-Premises versions 4.3.0 and earlier contain a privilege escalation vulnerability allowing authenticated administrators with limited privileges to gain full SuperAdmin access to…

How to fix or mitigate CVE-2026-78328?

Within 24 hours, audit NSM On-Prem administrator account logs and privilege change history to detect any suspicious SuperAdmin role assignments or escalations. Within 7 days, implement role-based access controls restricting lower-privileged administrator accounts to read-only access or isolated management functions, isolate NSM On-Prem management interfaces to a dedicated administrative network, and enable comprehensive audit logging of all administrative actions. Within 30 days, contact SonicWall support to confirm patch availability and timelines for versions 4.3.0 and earlier; upon patch release, prioritize deployment to all affected NSM On-Prem instances; if no patch emerges within 60 days, escalate to leadership for evaluation of platform replacement or persistent compensating-control deployment.

Network Security Manager Nsm CVE-2026-78328

EUVD-2026-71680 CRITICAL

Missing Authorization (CWE-862)

2026-09-04 sonicwall

GHSA-h2gj-x3qg-39wj

Authentication Bypass Sonicwall Network Security Manager Nsm

9.1

CVSS 3.1 · Vendor: sonicwall

Severity by source

Vendor (sonicwall) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (sonicwall) · only source for this CVE.

CVSS VectorVendor: sonicwall

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 04, 2026 - 20:52 vuln.today

CVSS changed

Sep 04, 2026 - 20:22 NVD

9.1 (CRITICAL)

CVE Published

Sep 04, 2026 - 18:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 04, 2026 - 18:19 cve.org

CRITICAL 9.1

DescriptionCVE.org

A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin.

AnalysisAI

The analysis is complete. Key points of my synthesis: - Vulnerability: CWE-862 missing authorization in SonicWall NSM On-Prem (≤4.3.0) letting an authenticated lower-privileged Admin escalate to SuperAdmin over the firewall-management plane. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, audit NSM On-Prem administrator account logs and privilege change history to detect any suspicious SuperAdmin role assignments or escalations. …

Threat intelligence, references, and detailed analysis are available after sign-in.