CVE-2026-100232
7.2HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-78
Impact
Authenticated attackers with high privileges can execute arbitrary OS commands remotely on the appliance. They must have network access and a valid high-privileged account on the system.
Root cause
The application fails to neutralize special elements in user-supplied input before passing it to an OS command.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to the fixed SonicWall Network Security Manager (NSM) on-prem release specified in advisory SNWLID-2026-0018. If you cannot patch immediately, restrict management network access to trusted administrative IPs only.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem which in specific conditions could potentially enable a remote authenticated attacker to execute arbitrary OS commands, resulting in remote code execution.