Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

SonicWall NSM management console lets admin run any command

CVE-2026-78327 · published today
Summary

The web interface used to manage SonicWall Network Security Manager can be tricked by a user who already has SuperAdmin rights into inserting system commands that the server will run. This could let the attacker take control of the server and access or modify data. Apply SonicWall’s latest update and restrict SuperAdmin accounts to trusted personnel immediately.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
sonicwall network security manager (nsm) 4.3.0 and earlier versions
Original advisory text
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an au...
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the underlying host, resulting in remote code execution.
References
Severity
9.1 Critical
Type
CWE-78OS Command Injection
Timeline
Published4 Sep 2026
Updated4 Sep 2026
First seen4 Sep 2026
Sources
CVE-2026-78327 · NVD
CVE-2026-78327 · MITRE
Monitor software like this
Free during beta