SonicWall NSM CVE-2026-96540

Exploitation requires a valid authenticated account on the SonicWall NSM on-prem instance (CVSS PR:L) and access to the export settings feature, which improperly discloses sensitive data across authorization boundaries. The attack is network-reachable over the NSM management interface with no user interaction (AV:N/UI:N). Realistic impact (intercepting other users' communications, escalating to administrator) presumes a multi-user/multi-tenant NSM deployment where other privileged users or credentials exist. Limiting factors: only NSM on-prem versions 4.3.1 and earlier are affected, valid low-privilege credentials are mandatory, and the hosted/SaaS NSM is not indicated as in scope.

This is a genuine but not emergency-grade priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication, and the C:H/I:H/A:H impact aligns with the vendor's description of privilege escalation to administrator and interception of other users' communications - consistent with SSVC Technical Impact of 'total'. However, several signals temper urgency and partly conflict: EPSS is only 0.20% (10th percentile), SSVC Exploitation is 'none' and Automatable is 'no', there is no CISA KEV listing, and no public exploit was identified. The requirement for a valid authenticated account (PR:L) is the key mitigating factor, making this an insider or post-compromise escalation vector rather than a mass-exploitable perimeter bug. Note a labeling conflict: the input Tags include 'Authentication Bypass,' but the CWE-863 classification and the stated need for an authenticated attacker indicate an improper-authorization/privilege-escalation issue, NOT an authentication bypass - verify tag against the SonicWall advisory. Net: patch-worthy given total technical impact on a security-management product, but current data does not indicate active or widespread exploitation.

A low-privileged but legitimate user of a SonicWall NSM on-prem instance invokes the export settings function, which improperly returns sensitive configuration or credential material belonging to the broader instance. Using that leaked data, the attacker escalates to an administrator role or intercepts communications of other NSM users. No public exploit code was identified at time of analysis, so this would require an attacker to independently develop the technique.