Loading story…
SonicWall disclosed two authenticated vulnerabilities in Network Security Manager (NSM) On-Prem that could expose sensitive information or enable remote code execution. CVE-2026-96540, an incorrect authorization flaw in export settings rated CVSS 8.8, could allow administrator privilege escalation or interception of other users’ communications. CVE-2026-100232, an OS command injection flaw rated CVSS 7.2, could let a highly privileged authenticated attacker execute arbitrary operating-system commands under specific conditions. SonicWall reported no current evidence of exploitation in the wild and said NSM SaaS versions are unaffected.
The Canadian Centre for Cyber Security reinforced the warning through advisory AV26-1048, covering VMware, Hyper-V, Azure, and KVM deployments; the accompanying Malware News report identifies NSM On-Prem 4.3.1 and earlier as affected. SonicWall urges affected customers to upgrade to a fixed release, while the Cyber Centre recommends reviewing the linked advisories and applying necessary updates as they become available. The supplied material does not identify the fixed version, so administrators should consult SonicWall’s advisory to confirm the appropriate upgrade target.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
On October 15, 2026, the Canadian Centre for Cyber Security issued advisory AV26-1048 covering multiple vulnerabilities in SonicWall NSM On-Prem across VMware, Hyper-V, Azure, and KVM deployments. The notice identified versions 4.3.1 and earlier as affected and encouraged users and administrators to review the linked advisories and apply necessary updates as they become available.
SonicWall disclosed CVE-2026-96540, an incorrect authorization flaw rated CVSS 8.8 that could expose sensitive information and enable administrator privilege escalation, and CVE-2026-100232, an OS command injection flaw rated CVSS 7.2 that could permit remote code execution. SonicWall urged affected users to upgrade to a fixed release, reported no evidence of exploitation in the wild, and stated that NSM SaaS was unaffected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcepsirt.global.sonicwall.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SonicWall disclosed multiple vulnerabilities in **Network Security Manager (NSM) On-Prem** affecting version **4.3.0 and earlier**. The affected deployments include VMware, Hyper-V, Microsoft Azure, and KVM environments under advisory `SNWLID-2026-0015`. The Canadian Centre for Cyber Security and Guyana National CIRT issued follow-on notices urging administrators to review SonicWall’s advisory and apply applicable updates as they become available. Public notices did not provide CVE identifiers, severity ratings, vulnerability details, exploitation status, or specific fixed-version information.
Sep 9, 2026
SonicWall disclosed multiple vulnerabilities affecting **Email Security** and **GMS**, prompting a Canadian Centre for Cyber Security advisory urging administrators to review vendor guidance and apply updates. The affected products include **SonicWall Email Security 10.0.35.8405 and earlier** and **SonicWall GMS 9.5.1 and earlier**. The Cyber Centre said the issues were current as of August 11 and advised organizations to deploy fixes as they become available. For **SonicWall Email Security**, SonicWall identified two authenticated code injection flaws, **`CVE-2026-66149`** and **`CVE-2026-66150`**, each rated **CVSS 7.8**, that could let a user with access to the restricted CLI inject arbitrary OS commands as **root** through the **netmask** and **SNMP** vectors. Separately, **`CVE-2026-66154`** affects **SonicWall GMS on Linux** and stems from **insufficient certificate validation** in a privileged communication workflow, creating a man-in-the-middle path to unauthorized changes under controlled network conditions. SonicWall said it had **no evidence of in-the-wild exploitation** for the Email Security flaws and directed customers to upgrade to fixed releases.
Aug 14, 2026
SonicWall has patched two vulnerabilities that are being actively exploited against **SMA 1000 Series** appliances, affecting models including **6210, 7210, and 8200v**. The flaws, tracked as **`CVE-2026-15409`** and **`CVE-2026-15410`**, impact multiple **12.4.3** and **12.5.0** platform-hotfix releases. SonicWall described `CVE-2026-15409` as a **critical unauthenticated SSRF** issue in the Appliance Work Place interface and `CVE-2026-15410` as a **high-severity code injection** flaw in the Appliance Management Console that can allow an authenticated administrator to execute arbitrary operating system commands. SonicWall said the vulnerabilities have been exploited together in the wild and released hotfixes to address them. Government and vendor advisories urged organizations to update immediately and investigate appliances for signs of compromise, warning that patching alone may not be sufficient if an appliance has already been breached. SonicWall recommended reviewing logs, re-imaging or re-deploying affected systems where indicators are found, changing user and administrator passwords, and resetting TOTP tokens. The **Canadian Centre for Cyber Security** highlighted the advisory, and **CISA** added both vulnerabilities to its **Known Exploited Vulnerabilities** catalog the same day, underscoring the urgency for defenders to remediate exposed SMA1000 deployments.
Aug 25, 2026