9/5/2026 • Security

SonicWall NSM Flaws: Three Steps From Admin Login to Root

SonicWall has patched three flaws in its on-prem Network Security Manager, two rated CVSS 9.1. None can be used by a stranger on the internet, but chained together they turn an ordinary admin login into root on the console that runs every firewall it manages.

SonicWall has patched three flaws in the on-premises version of its Network Security Manager (NSM), the console that many businesses and managed service providers use to run every SonicWall firewall they own from a single screen. Two of the three carry a CVSS score of 9.1 and end in remote code execution on the management host. The catch, and it is an important one, is that every one of them needs an attacker who is already logged in as an administrator. That doesn't make them harmless. It makes them a story about who holds the admin keys to the box that holds the keys to everything else.

What happened, in plain English

On 3 September 2026, SonicWall published advisory SNWLID-2026-0015, covering three vulnerabilities in NSM On-Prem, the self-hosted virtual appliance for VMware, Hyper-V, Azure and KVM. All three were reported privately by researchers at Pentest-Tools.com, and all three are fixed in version 4.3.1-R4. Every release up to and including 4.3.0 is affected. There is no workaround.

CVE-2026-78327, OS command injection (CVSS 9.1). The management interface passes input from a logged-in SuperAdmin into a system command without cleaning it up first. A SuperAdmin who slips shell characters into that input can run whatever they like on the underlying host. That is remote code execution, but only for someone who already holds the highest role the product has.
CVE-2026-78328, privilege escalation (SonicWall rates it CVSS 7.2). A missing authorisation check lets an ordinary Admin account promote itself to SuperAdmin. On its own that sounds tame. Combined with the first flaw it isn't: it is the step that turns "one of our admins" into "someone who can run commands on the console". At the time of writing the NVD record lists this one at 9.1 rather than the vendor's 7.2, and the entry is still marked as awaiting analysis, so expect the number to settle.
CVE-2026-81939, Zip Slip (CVSS 9.1). The file-upload and archive-handling feature can be tricked by a crafted archive into writing files outside the folder it was meant to touch. Again, the CVSS vector says high privileges are required.

Two things the headlines tend to skip, stated plainly. First, none of these can be exploited by a stranger on the internet without a valid login; the CVSS vector for every one reads "privileges required: high". Second, SonicWall says there is currently no evidence of exploitation in the wild, and as of 4 September none of the three appears in CISA's Known Exploited Vulnerabilities catalogue. We checked. That is a genuinely better position than the SMA 1000 zero-days we covered earlier this week, which were being used in real attacks before a fix existed.

SonicWall's cloud-hosted NSM SaaS is not affected.

Why it matters: the chain, not the score

Read individually, these look like a "patch when convenient" set. Read together, they describe a path. An Admin account, the kind you might hand to a junior technician, an outsourced IT provider, or the person who left six months ago and whose login nobody deleted, steps up to SuperAdmin through the second flaw, then uses the first to run commands on the host. From there the attacker isn't just on a server. They are on the server that pushes policy to every firewall in the business. A changed rule, an opened port, logging quietly switched off: the firewalls will do as they're told, because the instruction came from the console they trust.

That is the pattern we keep seeing in management planes. We made the same point about Cisco's Firewall Management Center in August: a bug in the thing that manages the firewalls is worth more to an attacker than a bug in any single firewall. The difference this time is where the risk lives. The SMA 1000 story was about the outside world getting in. This one is about what a trusted login can be turned into.

"Authenticated only" is reassuring right up until you count how many people are authenticated. Shared admin passwords, credentials reused from a breached service, a phished technician, a contractor who kept access after the contract ended: each is a way an attacker becomes "an authenticated Admin" without ever touching the vulnerability itself. The flaw just decides what happens next.

The honest bit

No vendor is immune, including the ones we like. We sell Cisco and Meraki gear, and Cisco's own firewall management console had a hardcoded credential exploited in the wild in July. SonicWall, for its part, handled this one well: the flaws came from outside researchers, were fixed in a numbered release, and were published with a straight statement about exploitation and a clear affected-versions table. It is also worth noting that this is not the first authenticated command injection in NSM On-Prem; a similar flaw, CVE-2021-20026, was patched in 2021. Same product, same class of bug, five years apart. That's not a reason to distrust SonicWall. It is a reminder that management consoles are complicated software and will keep needing patches for as long as you run them.

One detail from the advisory is worth weighing, offered as advice rather than a pitch: the cloud-hosted NSM SaaS wasn't affected, and its customers had nothing to install. Anyone running the on-prem virtual appliance has to notice the advisory, download 4.3.1-R4 and schedule the upgrade themselves. That gap in who carries the patching burden is the same one we described in why a cloud-managed firewall keeps getting better after you buy it. It won't suit every business, but it is a real difference.

What we'd suggest you actually do

If you run NSM On-Prem, upgrade to 4.3.1-R4 or later. There is no workaround. Check the version in your console; anything 4.3.0 or earlier is affected on every hypervisor.
Count the admins. List every account on the console with Admin or SuperAdmin rights, including your IT provider's. Remove anyone who no longer needs it, and make sure no two people share a login. This trio of flaws is only as dangerous as the number of people who can start the chain.
Give the fewest people the highest role. SuperAdmin should be a handful of named accounts at most. Day-to-day work belongs in lower roles, so a compromised everyday login has further to climb.
Turn on multi-factor authentication for the management console and keep it off the public internet. Restrict it to your internal network or a VPN. A stolen password is far less useful if it can't reach the login page.
Watch the console the way you'd watch a firewall. Review who logged in, when, and from where, and look for unexpected role changes or file uploads. If you have no easy way to see that today, our piece on spotting an intruder on a small business network is a starting point.
Ask your managed service provider the same questions. If someone else runs NSM on your behalf, ask which version they're on, who has admin rights to your tenant, and whether MFA is enforced. Good providers will have the answers ready.

The friendly takeaway

These three flaws won't let a stranger walk in off the internet, and nobody appears to be exploiting them yet. That is the good news, and it is worth saying clearly rather than dressing a 9.1 up as an emergency. The lesson is quieter: the console that runs your firewalls is a high-value target, and the accounts that can log into it deserve the same care as the firewalls themselves. Patch this week, then spend ten minutes counting who has admin.

We keep an eye on advisories like this so you don't have to. If you'd ever like a second pair of eyes over your network management setup, what's exposed, who has access, what's fallen behind on patches, get in touch. No obligation and no hard sell.

What happened, in plain English

Why it matters: the chain, not the score

The honest bit

What we'd suggest you actually do

The friendly takeaway

References