EUVD-2026-71681
GHSA-8249-x575-f5g2
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-reachable management UI (AV:N/AC:L) but archive import requires a privileged NSM account (PR:H); arbitrary file write on the host escapes component scope (S:C) enabling C/I/A:H via overwrite-to-code-execution.
Primary rating from Vendor (sonicwall).
CVSS VectorVendor: sonicwall
Lifecycle Timeline
4DescriptionCVE.org
A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive.
AnalysisAI
Arbitrary file write via Zip Slip in SonicWall Network Security Manager (NSM) On-Prem (versions 4.3.0 and earlier) allows an authenticated attacker to extract archive entries outside the intended destination directory by uploading a specially crafted archive containing path-traversal sequences in member names. Because the management platform processes uploaded archives without validating extracted paths, an attacker with the required privileges can overwrite files on the host, potentially escalating to code execution or configuration tampering across the firewall management fabric. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated, high-privilege NSM account (CVSS PR:H) with access to the On-Prem file-upload and archive-processing feature, and the target must run NSM 4.3.0 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 score is 9.1 (Critical) with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - network-reachable, low complexity, but requiring high privileges (PR:H) and no user interaction, with a scope change (S:C) reflecting impact beyond the vulnerable component to the managed host/firewall fabric. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade SonicWall NSM On-Prem to a fixed release above 4.3.0 as directed by SonicWall advisory SNWLID-2026-0015 (https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0015); the input does not specify an exact patched build, so confirm the fixed version directly from the advisory before deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all NSM On-Prem deployments running version 4.3.0 or earlier; immediately restrict NSM management console network access to designated administrative networks only, enforcing MFA on all administrative accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Network Security Manager Nsm
View allRemote code execution in SonicWall Network Security Manager (NSM) On-Prem 4.3.0 and earlier allows a SuperAdmin-authenti
The analysis is complete. Key points of my synthesis: - **Vulnerability**: CWE-862 missing authorization in SonicWall N
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today