CVE-2026-96540: sonicwall network security manager (nsm) Incorrect Authorization

Vulnerability summary

CVE-2026-96540 is a high (CVSS 8.8) Incorrect Authorization vulnerability in sonicwall network security manager (nsm). EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22.5% of scored vulnerabilities.

Timeline

1. 14-10-2026
   PublishedVulnerability first disclosed.
2. 15-10-2026
   Last modifiedVulnerability information updated.

Description

An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information. This may allow the attacker to escalate privileges to an administrator or to intercept communications of other users of the NSM instance.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.