SonicWall NSM EUVD-2026-71681

Exploitation requires an authenticated, high-privilege NSM account (CVSS PR:H) with access to the On-Prem file-upload and archive-processing feature, and the target must run NSM 4.3.0 or earlier. The attacker must supply a specially crafted archive whose member names contain directory-traversal sequences ('../') or absolute paths. Limiting factors: it is NOT unauthenticated (a valid privileged session is mandatory), no user interaction by a victim is needed (UI:N), and it applies to the On-Prem deployment specifically; the archive-import/file-upload capability must be reachable for the account used. These conditions constrain realistic exploitation to insiders or attackers who have already compromised a privileged management account.

The vendor CVSS 3.1 score is 9.1 (Critical) with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - network-reachable, low complexity, but requiring high privileges (PR:H) and no user interaction, with a scope change (S:C) reflecting impact beyond the vulnerable component to the managed host/firewall fabric. The PR:H requirement is the single most important limiter: exploitation is not anonymous, so realistic risk hinges on an attacker already holding a privileged NSM account (or having compromised one). No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or automatable mass-scanning; this reads as a high-severity-but-authentication-gated issue rather than an internet-wide worming risk. The C:H/I:H/A:H triple is defensible because arbitrary file write on a management appliance can plausibly overwrite binaries/config and yield code execution. Note a mild tension: the 9.1 score is driven heavily by S:C and the impact triad, but PR:H meaningfully narrows the exploit population versus a PR:N critical - prioritize based on how tightly NSM admin/operator access is controlled in your environment.

An attacker who has obtained privileged NSM credentials (e.g., via phishing, credential reuse, or an insider) logs into the On-Prem console and uploads a crafted ZIP whose entries contain '../../' path-traversal names. During archive processing NSM writes those entries outside the intended directory, overwriting a script or configuration file on the host, which is later executed to gain code execution on the management appliance. No public POC is identified at time of analysis, and the network-facing, low-complexity nature (AV:N/AC:L) makes exploitation straightforward once the privilege prerequisite is met.