# SonicWall NSM On-Prem Flaws (CVE-2026-96540, CVE-2026-100232) Allow Privilege Escalation, Communication Interception and OS Command Execution

> SonicWall disclosed two vulnerabilities in Network Security Manager (NSM) On-Prem 4.3.1 and earlier: an improper access control flaw (CVE-2026-96540, CVSS 8.8) and a post-authentication OS command injection flaw (CVE-2026-100232, CVSS 7.2). Authenticated attackers could escalate privileges, intercept user communications and execute arbitrary OS commands. Fixed in NSM 4.4.0 and higher; no evidence of exploitation in the wild has been reported.

- **Published:** 2026-10-15T08:19:15Z
- **Last reviewed:** 2026-10-15T08:19:15Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3596
- **ID:** TL-2026-3596
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-96540, CVE-2026-100232, CVE-2021-20026

## Description

On 2026-10-14 SonicWall published advisory SNWLID-2026-0018 covering two vulnerabilities in the on-premises edition of Network Security Manager (NSM), the centralized management platform for SonicWall firewalls. Affected deployments are NSM On-Prem 4.3.1 and earlier, delivered as virtual appliances on VMware, Hyper-V, Azure and KVM. The SaaS edition of NSM is not affected.

CVE-2026-96540 (CWE-863, Incorrect Authorization; CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N) is an improper access control flaw. The NVD description places it in NSM's export settings and states that a remote authenticated attacker may be able to obtain sensitive information; press coverage (GBHackers) describes the broader impact as privilege escalation and interception of other users' communications. Only low privileges are required.

CVE-2026-100232 (CWE-78, OS Command Injection; CVSS 3.1 7.2, AV:N/AC:L/PR:H/UI:N) is a post-authentication OS command injection. Per NVD, an authenticated remote attacker can run arbitrary OS commands and may reach remote code execution under specific conditions on Linux on-premises deployments. It requires high privileges.

Chained, the two flaws would allow a low-privilege account holder to first escalate privileges and then execute operating system commands, giving full control of the NSM platform, which in turn manages firewall policy and configuration for the downstream estate. The published sources do not describe the exact request path, parameter or trigger for either flaw, and no public proof-of-concept, IOCs, malware or threat-actor attribution have been reported. SonicWall states there is no workaround; upgrading to NSM 4.4.0 or later is required. Neither CVE appeared in the CISA KEV catalog at the time of research. Credited researchers are Andrei Lungu (CVE-2026-96540) and Andrei Lungu and Matei Badanoiu of Pentest-Tools.com (CVE-2026-100232); reporter IDs PTT-2026-025 and PTT-2026-014 are cited. NSM has a history of authenticated command injection (e.g. CVE-2021-20026), and an earlier cluster of NSM advisories (SNWLID-2026-0015) was released in September 2026.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1059.004 Unix Shell
- T1005 Data from Local System
- T1040 Network Sniffing

## Sources

- [SonicWall NSM Bugs Let Attackers Intercept Communications and Execute Commands (GBHackers)](https://gbhackers.com/sonicwall-nsm-security-flaws/)
- [SonicWall PSIRT Advisory SNWLID-2026-0018](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0018)
- [NVD - CVE-2026-96540](https://nvd.nist.gov/vuln/detail/CVE-2026-96540)
- [NVD - CVE-2026-100232](https://nvd.nist.gov/vuln/detail/CVE-2026-100232)
- [CISA Known Exploited Vulnerabilities Catalog (neither CVE listed at time of research)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Canadian Centre for Cyber Security - SonicWall security advisory AV26-884 (earlier NSM advisories, context)](https://cyber.gc.ca/en/alerts-advisories/sonicwall-security-advisory-av26-884)
- [SecurityWeek - SonicWall patches command injection flaw in firewall management application (prior NSM flaw CVE-2021-20026, context)](https://www.securityweek.com/sonicwall-patches-command-injection-flaw-firewall-management-application/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3596