CVE-2026-96540
8.8HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-863
Impact
Authenticated attackers can escalate privileges to administrator or intercept other users' communications via exported settings. They only need low-privilege network access to an on-prem NSM instance.
Root cause
Improper access control in the export settings feature exposes sensitive configuration data to authenticated users.
Affected systems
SonicWall Network Security Manager (NSM) on-prem; exact versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to the fixed SonicWall NSM on-prem build referenced in advisory SNWLID-2026-0018, or restrict network access to the NSM administrative interface to trusted management networks while awaiting patching.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information. This may allow the attacker to escalate privileges to an administrator or to intercept communications of other users of the NSM instance.