CVE-2026-78327CWE-78command-injection

CVE-2026-78327

Critical · published September 4, 2026

CVSS v3.1
9.1
EPSS
2%
Percentile
74.9
In the wild
Unconfirmed
What it is

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the underlying host, resulting in remote code execution.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01551 · 74.9th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-09-04T23:17Z
References (1)
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0015 · [email protected]
EPSS history
Timeline
  • 06 SEP 03:33Z
    EPSS moved — → 2%
    epss
  • 04 SEP 18:14Z
    An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Security Manager (NSM)…
    cvelistv5