CERT-FR: Multiple SonicWall Network Security Manager vulnerabilities allow remote code execution and security policy bypass

Linha do tempo

1. cert.ssi.gouv.fr ↗ · pub. 14/10/2026 21:00 · coletado 20/10 16:32 primeiro registro

   CERT-FR: Multiple SonicWall Network Security Manager vulnerabilities allow remote code execution and security policy bypass

   ler a análise desta fonte ocultar

   CERT-FR advisory CERTFR-2026-AVI-1320, published 15 October 2026, reports multiple vulnerabilities in SonicWall Network Security Manager (NSM) On-Prem that allow a remote attacker to execute arbitrary code and bypass the security policy. The advisory references CVE-2026-100232 and CVE-2026-96540, based on SonicWall bulletin SNWLID-2026-0018 dated 14 October 2026. It does not state whether any flaw is exploited in the wild, and gives no per-CVE technical detail, CVSS score, IOCs or attribution.

   Technical Details

   • Affected: SonicWall Network Security Manager On-Prem (VMware, Hyper-V, Azure and KVM) versions prior to 4.4.0.
   • Impact: remote arbitrary code execution and security policy bypass.
   • Vendor bulletin: SNWLID-2026-0018.
   • The advisory does not map individual CVEs to specific impacts or state whether authentication is required.

   Remediation

   • Consult SonicWall bulletin SNWLID-2026-0018 and upgrade NSM On-Prem to version 4.4.0 or later.