CVE-2026-100232

HighCVSS 7.2

Published: 14/10/2026(UTC)Updated: 15/10/2026(UTC)Translated: 15/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.15%

66th percentile - higher than 66% of all known CVEs

Summary

A post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in SonicWall Network Security Manager (NSM) on-prem. Under specific conditions, a remote authenticated attacker could execute arbitrary OS commands, resulting in remote code execution.

Risk Assessment

An authenticated attacker could take control of the system by executing arbitrary code, potentially leading to full compromise of the NSM appliance and further lateral movement within the network.

Recommendation

Apply security patches for SonicWall NSM on-prem as soon as possible, enforce least privilege for administrative accounts, and audit for unusual command execution.

Other vulnerabilities in SonicWall Network Security Manager

CVE-2026-96540High
An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings. A remote authenticated attacker could obtain sensitive information, potentially escalating privileges to administrator or intercepting communications of other NSM instance users.

Original NVD description (English source)

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem which in specific conditions could potentially enable a remote authenticated attacker to execute arbitrary OS commands, resulting in remote code execution.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS