CVE-2026-78327
CriticalCVSS 9.1Summary
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the underlying host, resulting in remote code execution.
Risk Assessment
An attacker with SuperAdmin privileges can take control of the host operating system, potentially leading to complete compromise of the security manager and the entire managed infrastructure.
Recommendation
Update SonicWall NSM On-Prem to the latest patched version and minimize the number of SuperAdmin accounts, monitoring their activity.
Other vulnerabilities in SonicWall Network Security Manager (NSM) On-Prem
See all- CVE-2026-81939Critical
A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive.
- CVE-2026-78328Critical
A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin.
Original NVD description (English source)
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the underlying host, resulting in remote code execution.