CVE-2026-78328
published 2026-09-04CVE-2026-78328: A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to…
PriorityP354critical9.1CVSS 3.1
AVNACLPRHUINSCCHIHAH
EPSS
0.50%
41.4th percentile
A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sonicwall | network_security_manager | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin.
ghsa_unreviewed·2026-09-04
CVE-2026-78328 [CRITICAL] CWE-862 A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin.
A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin.
VulDB
SonicWall Network Security Manager On-Prem Management Interface privileges management
vuldb·2026-09-04·CVSS 9.1
CVE-2026-78328 [CRITICAL] SonicWall Network Security Manager On-Prem Management Interface privileges management
A vulnerability has been found in SonicWall Network Security Manager and classified as very critical. This affects an unknown function of the component On-Prem Management Interface. The manipulation leads to improper privilege management.
This vulnerability is listed as CVE-2026-78328. The attack may be initiated remotely. There is no available exploit.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-04
Published