EUVD-2026-101630
GHSA-r842-j9qr-cw6f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privilege NSM credentials
-
DeliveryAuthenticate to NSM management interface
-
ExploitInject shell metacharacters into vulnerable command input
-
ExecutionTrigger OS command injection (CWE-78)
-
PersistExecute arbitrary commands as service user
-
ImpactFull compromise of NSM host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a remote but AUTHENTICATED attacker holding HIGH privileges (CVSS PR:H) - i.e., an administrative/privileged account on the SonicWall Network Security Manager (NSM) on-prem console; this is the primary limiting factor and excludes anonymous internet attackers. The affected scope is NSM on-prem version 4.3.1 and earlier (cloud-hosted NSM is not indicated as affected). The vendor explicitly states the flaw is reachable only 'in specific conditions,' which the available data does not enumerate, so a specific feature/configuration prerequisite likely applies and should be confirmed against SNWLID-2026-0018. No user interaction is required (UI:N) once the privileged session exists. |
| Impact | This is a genuine but moderate-priority issue rather than an urgent emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, score 7.2, HIGH) indicates network-reachable exploitation with low attack complexity but requires HIGH privileges (PR:H), meaning the attacker must already hold a privileged/administrative account on the NSM instance - a significant barrier that caps real-world risk. Multiple signals agree that exploitation is not imminent: EPSS is only 0.54% (44th percentile), the vulnerability is NOT in CISA KEV, and CISA SSVC scores Exploitation as 'none' and Automatable as 'no'. The one signal pulling the other way is SSVC Technical Impact = 'total', consistent with the C:H/I:H/A:H impact and the OS-command-injection→RCE outcome. Note a tension worth verifying: the description says the flaw is exploitable only 'in specific conditions,' which argues for higher attack complexity than the vendor's AC:L rating - the practical likelihood may be lower than AC:L implies. No public exploit identified at time of analysis, so this is a patch-in-normal-cycle item: prioritized because of total technical impact and post-auth RCE, but de-prioritized relative to unauthenticated or actively-exploited flaws because of the PR:H requirement and the undefined 'specific conditions.' |
| Exploit ScenarioDerived | An attacker who has already obtained high-privilege (administrative) credentials to an on-prem SonicWall NSM console - via phishing, credential reuse, or a prior compromise - reaches an input field that is passed unsanitized into an OS command and injects shell metacharacters to run arbitrary commands on the underlying host. Because the NSM manages fleets of firewalls, successful code execution could cascade into broader network-security management compromise. No public exploit code is identified at time of analysis, and the description notes exploitation is possible only 'in specific conditions.' |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Authenticated attackers with high privileges on SonicWall Network Security Manager (NSM) on-prem can execute arbitrary OS commands via an OS command injection flaw (CWE-78), achieving remote code execution. The vulnerability affects NSM on-prem versions 4.3.1 and earlier, requires a privileged session (PR:H), and is assessed with high attack complexity (AC:H) due to unenumerated specific conditions. No public exploit code or active exploitation has been identified (CISA KEV status: none; SSVC exploitation: none), and the EPSS score is 0.54% (44th percentile), indicating a moderate-priority risk rather than an urgent emergency.
RemediationAI
Apply the vendor-released patch as directed in SonicWall advisory SNWLID-2026-0018; upgrade NSM on-prem to a version later than 4.3.1 (exact fixed version not specified in the provided data). Until patching is possible, restrict network access to the NSM management interface to trusted administrative networks, and limit high-privilege accounts to essential personnel. Monitor administrative accounts for suspicious command execution or unexpected OS-level activity, since exploitation requires authenticated admin access. There are no known workarounds beyond access controls, and the trade-off is reduced administrative convenience. Refer to the vendor advisory for any additional mitigations or configuration hardening steps.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a post-authentication OS command injection (CWE-78) in SonicWall Network Security Manager (NSM) on-prem, a management platform for SonicWall firewalls. The flaw arises from improper neutralization of special elements used in an OS command, allowing a remote authenticated attacker with high privileges (CVSS PR:H) to execute arbitrary commands on the underlying operating system, leading to remote code execution. The affected scope is NSM on-prem version 4.3.1 and earlier, as indicated by the CPE cpe:2.3:a:sonicwall:network_security_manager_(nsm):*:*:*:*:*:*:*:* and EUVD data; cloud-hosted NSM is not indicated as affected. The vendor-provided CVSS vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, but independent assessment adjusts attack complexity to high (AC:H), reflecting that exploitation requires specific conditions that are not fully enumerated in available data and should be confirmed against vendor advisory SNWLID-2026-0018. The SSVC decision framework rates exploitation as 'none', automatable as 'no', and technical impact as 'total', consistent with the high-privilege prerequisite limiting the attack surface.
Know when Network Security Manager Nsm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable management console (AV:N) but requires an admin account (PR:H) and the vendor's 'specific conditions' wording justifies AC:H; OS command injection yields total host impact (C:H/I:H/A:H).
Primary rating from Vendor (sonicwall).
CVSS VectorVendor: sonicwall
Lifecycle Timeline
3DescriptionCVE.org
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem which in specific conditions could potentially enable a remote authenticated attacker to execute arbitrary OS commands, resulting in remote code execution.
Executive ViewAI
SonicWall Network Security Manager (NSM) on-premises deployments at version 4.3.1 and earlier carry a high-severity command injection flaw that lets an attacker who already holds a privileged account execute operating system commands and gain full control of the management appliance. Because NSM is a central console for configuring and monitoring firewall estates, compromise of that single host could expose policy data, credentials, and the security posture of the entire network it governs. The risk is currently contained by the narrow access required, the not-yet-published exploit code, and a low exploit-probability score, but leadership should treat the missing vendor fix and the appliance's privileged position as a standing exposure that must be actively mitigated.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict administrative access to the NSM on-prem console through network segmentation and source-IP allowlisting; enforce MFA and least privilege for all privileged accounts; disable unused or default accounts and rotate credentials for accounts with NSM administrative rights; enable and centrally retain audit logging with alerting on command-execution and configuration changes; monitor the SonicWall advisory and CISA KEV catalog for a patch or change in exploitation status; consider isolating or migrating management functions off the affected 4.3.1-and-earlier instances until a fix is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Network Security Manager Nsm
View allRemote code execution in SonicWall Network Security Manager (NSM) On-Prem 4.3.0 and earlier allows a SuperAdmin-authenti
Arbitrary file write via Zip Slip in SonicWall Network Security Manager (NSM) On-Prem (versions 4.3.0 and earlier) allow
The analysis is complete. Key points of my synthesis: - **Vulnerability**: CWE-862 missing authorization in SonicWall N
Improper access control in the export settings feature of SonicWall Network Security Manager (NSM) on-prem let a remote
Exploit-DB