CVE-2026-78328
CriticalCVSS 9.1Summary
A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin.
Risk Assessment
A user with limited privileges can gain full control over the security manager, enabling security configuration changes, policy bypass, and potential compromise of the entire protected network.
Recommendation
Update SonicWall NSM On-Prem to a patched version and review user privileges to ensure no unnecessary Admin accounts exist.
Other vulnerabilities in SonicWall Network Security Manager (NSM) On-Prem
See all- CVE-2026-81939Critical
A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive.
- CVE-2026-78327Critical
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the underlying host, resulting in remote code execution.
Original NVD description (English source)
A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin.