CVE-2026-100232: OS Command Injection
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem which in specific conditions could potentially enable a remote authenticated attacker to execute arbitrary OS commands, resulting in remote code execution.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker must be authenticated to the SonicWall Network Security Manager (NSM) on-prem application. The issue is only described as exploitable under specific conditions; those conditions are not provided.
What is the potential impact after exploitation?
An authenticated attacker may be able to execute arbitrary operating-system commands on the affected NSM on-prem system, resulting in remote code execution.
Is an unauthenticated or default deployment known to be affected?
The available information does not describe unauthenticated exploitation or state whether a default configuration is affected. Authentication is explicitly required.