CVE-2026-96540

Awaiting Analysis Awaiting Analysis - Queue

Improper Access Control in SonicWall NSM On-Prem

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: SonicWALL, Inc.

Description

An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information. This may allow the attacker to escalate privileges to an administrator or to intercept communications of other users of the NSM instance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-96540

EUVD

EUVD-2026-101629

Affected Vendors & Products

Vendor	Product	Version / Range
SonicWall	Network	Security Manager (NSM) 4.3.1 and earlier versions

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This is an improper access control vulnerability in SonicWall Network Security Manager (NSM) on-prem. It affects export settings and could let a remote authenticated attacker access sensitive information. The attacker might escalate privileges to administrator level or intercept communications of other NSM users.

Impact Analysis

If exploited, this flaw could let attackers steal sensitive data, gain full admin control over your NSM instance, or spy on other users' communications. This may lead to data breaches, unauthorized system changes, or loss of confidential information.

Compliance Impact

The improper access control vulnerability in SonicWall NSM could lead to unauthorized access to sensitive information, potentially violating data protection requirements under GDPR and HIPAA. Exposure of sensitive data may result in non-compliance with these regulations, depending on the nature of the data involved.

Mitigation Strategies

Immediately update SonicWall Network Security Manager (NSM) to the latest patched version to address the improper access control vulnerability. Restrict network access to NSM administrative interfaces and review user permissions to ensure least privilege access.

Hi! I’m here to help you understand CVE-2026-96540. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70