Threat reportVulnerabilityTL-2026-3596
SonicWall NSM On-Prem Flaws (CVE-2026-96540, CVE-2026-100232) Allow Privilege Escalation, Communication Interception and OS Command Execution
SonicWall NSM On-Prem Flaws (CVE-2026-96540 (TL-2026-3596), also tracked as SNWLID-2026-0018, is a high-severity software vulnerability scored CVSS 8.8, first published 2026-10-15. It has no confirmed attribution, affects SonicWall Network Security Manager (NSM) On-Prem, references 3 CVEs (CVE-2026-96540, CVE-2026-100232, CVE-2021-20026), maps to 4 MITRE ATT&CK techniques (T1005, T1040, T1059.004), and is covered by 9 detection rules and 7 indicators of compromise.
- CVSS
- 8.8/10High
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-3596
- Threat ID
- TL-2026-3596
- Also known as
- SNWLID-2026-0018
- Severity
- HIGH
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, education, telecoms, manufacturing
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 7
How SonicWall NSM On-Prem Flaws (CVE-2026-96540 works
SonicWall disclosed two vulnerabilities in Network Security Manager (NSM) On-Prem 4.3.1 and earlier: an improper access control flaw (CVE-2026-96540, CVSS 8.8) and a post-authentication OS command injection flaw (CVE-2026-100232, CVSS 7.2). Authenticated attackers could escalate privileges, intercept user communications and execute arbitrary OS commands. Fixed in NSM 4.4.0 and higher; no evidence of exploitation in the wild has been reported.
On 2026-10-14 SonicWall published advisory SNWLID-2026-0018 covering two vulnerabilities in the on-premises edition of Network Security Manager (NSM), the centralized management platform for SonicWall firewalls. Affected deployments are NSM On-Prem 4.3.1 and earlier, delivered as virtual appliances on VMware, Hyper-V, Azure and KVM. The SaaS edition of NSM is not affected.
CVE-2026-96540 (CWE-863, Incorrect Authorization; CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N) is an improper access control flaw. The NVD description places it in NSM's export settings and states that a remote authenticated attacker may be able to obtain sensitive information; press coverage (GBHackers) describes the broader impact as privilege escalation and interception of other users' communications. Only low privileges are required.
CVE-2026-100232 (CWE-78, OS Command Injection; CVSS 3.1 7.2, AV:N/AC:L/PR:H/UI:N) is a post-authentication OS command injection. Per NVD, an authenticated remote attacker can run arbitrary OS commands and may reach remote code execution under specific conditions on Linux on-premises deployments. It requires high privileges.
Chained, the two flaws would allow a low-privilege account holder to first escalate privileges and then execute operating system commands, giving full control of the NSM platform, which in turn manages firewall policy and configuration for the downstream estate. The published sources do not describe the exact request path, parameter or trigger for either flaw, and no public proof-of-concept, IOCs, malware or threat-actor attribution have been reported. SonicWall states there is no workaround; upgrading to NSM 4.4.0 or later is required. Neither CVE appeared in the CISA KEV catalog at the time of research. Credited researchers are Andrei Lungu (CVE-2026-96540) and Andrei Lungu and Matei Badanoiu of Pentest-Tools.com (CVE-2026-100232); reporter IDs PTT-2026-025 and PTT-2026-014 are cited. NSM has a history of authenticated command injection (e.g. CVE-2021-20026), and an earlier cluster of NSM advisories (SNWLID-2026-0015) was released in September 2026.
MITRE ATT&CK techniques used in TL-2026-3596
Collection
Credential Access
Execution
Initial Access
Affected products and versions in SonicWall NSM On-Prem Flaws (CVE-2026-96540
- SonicWall — Network Security Manager (NSM) On-Prem
Vulnerable versions: 4.3.1 and earlier (VMware, Hyper-V, Azure, KVM)
Fixed in: 4.4.0 and higher
Remediation for SonicWall NSM On-Prem Flaws (CVE-2026-96540
Patches
- SonicWall NSM On-Prem 4.4.0 and later (advisory SNWLID-2026-0018)
Immediate actions
- Upgrade SonicWall NSM On-Prem to version 4.4.0 or higher
- Restrict access to the NSM management interface to trusted networks only
- Audit NSM user accounts and remove or disable unneeded low-privilege accounts
- Review NSM export activity and administrative logs for unexpected use
- Rotate credentials that may have been exposed through NSM
Workarounds
- None available per SonicWall; upgrade is required
Longer-term hardening
- Place NSM management planes behind VPN or jump-host access
- Forward NSM audit and system logs to a SIEM and alert on anomalous export and command activity
- Apply least-privilege role assignment for NSM users
CVEs associated with SonicWall NSM On-Prem Flaws (CVE-2026-96540
Weaknesses (CWE) in SonicWall NSM On-Prem Flaws (CVE-2026-96540
Timeline of SonicWall NSM On-Prem Flaws (CVE-2026-96540
- Earlier NSM On-Prem authenticated OS command injection (CVE-2021-20026, CVSS 8.8) patched by SonicWall, showing a recurring flaw class in the product
- ANSSI and SonicWall publish advisories for earlier NSM On-Prem vulnerabilities (SNWLID-2026-0015) affecting versions before 4.3.1-R4
- CVE-2026-96540 (CWE-863) and CVE-2026-100232 (CWE-78) published in NVD referencing the SonicWall advisory
- NSM On-Prem 4.4.0 and higher identified as fixed releases; SonicWall states no workaround exists
- SonicWall publishes advisory SNWLID-2026-0018 for CVE-2026-96540 and CVE-2026-100232 in NSM On-Prem 4.3.1 and earlier
- Neither CVE found in the CISA Known Exploited Vulnerabilities catalog at the time of research
- GBHackers reports the flaws, crediting Andrei Lungu and Matei Badanoiu of Pentest-Tools.com; no evidence of active exploitation reported
Sources cited for SonicWall NSM On-Prem Flaws (CVE-2026-96540
- SonicWall NSM Bugs Let Attackers Intercept Communications and Execute Commands (GBHackers)
- SonicWall PSIRT Advisory SNWLID-2026-0018
- NVD - CVE-2026-96540
- NVD - CVE-2026-100232
- CISA Known Exploited Vulnerabilities Catalog (neither CVE listed at time of research)
- Canadian Centre for Cyber Security - SonicWall security advisory AV26-884 (earlier NSM advisories, context)
- SecurityWeek - SonicWall patches command injection flaw in firewall management application (prior NSM flaw CVE-2021-20026, context)
Detection coverage for TL-2026-3596
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3596 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.