CVE-2026-96540
improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information
CVE-2026-96540: improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings…
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
CVE-2026-96540 at a glance
- CISA KEV
- Not listed (catalog checked )
- Highest advisory severity
- High
- Vendor advisories
- 2 from SonicWall
- VulniPulse record
- Published · Updated
Is CVE-2026-96540 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2026-96540 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2026-96540?
The tracked advisories that cover only this CVE do not list a fixed release yet. That does not mean no fix exists; check each vendor source below.
Vendor advisory comparison
SonicWall
2 advisories- Advisory severityHigh8.8
High [CVE-2026-100232 +1] Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability ha…
SNWLID-2026-0018Source published Source updated
This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem which in specific conditions could potentially enable a remote authenticated attacker to execute arbitrary OS commands, resulting in remote code execution.
- Related products — impact not confirmed
- No product details extracted. Check the source bulletin.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem which in specific conditions could potentially enable a remote authenticated attacker to execute arbitrary OS commands, resulting in remote code execution.
- Advisory severityUnrated
Advisory [CVE-2026-96540] improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information
CVE-2026-96540Source published Source updated
An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information. This may allow the attacker to escalate privileges to an administrator or to intercept communications of other users of the NSM instance.
- Affected products in this advisory
- Network Security Manager (NSM)
- Source-reported affected versions
- Network Security Manager (NSM) 4.3.1 and earlier versions
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Browse the latest tracked CVEs or the CVEs listed in CISA KEV.
Android app · Google Play
Monitor future SonicWall CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.