【Vulnerability Alert】2 Critical Security Vulnerabilities Found in SonicWall NSM On-Prem

• Subject: 【Vulnerability Alert】2 Critical Security Vulnerabilities Found in SonicWall NSM On-Prem

• Description:
  • Forwarded security alert TWCERTCC-200-202609-00000002 from Taiwan Computer Emergency Response Team/Coordination Center (TWCERT/CC).
  • SonicWall has issued a advisory regarding critical security vulnerabilities in NSM On-Prem (CVE-2026-78327, CVSS: 9.1 and CVE-2026-81939, CVSS: 9.1). CVE-2026-81939 is a Zip Slip vulnerability residing in the file upload and archive handling functionality of NSM On-Prem, allowing attackers to extract files outside the intended target directory using crafted files. CVE-2026-78327 is an OS Command Injection vulnerability that allows authenticated attackers with SuperAdmin privileges to execute arbitrary commands on the underlying host, resulting in remote code execution.
• Affected Platforms:
  • Network Security Manager (NSM) On-Prem version 4.3.0 and prior versions
• Recommendations:
  • Please update to the following version: Network Security Manager (NSM) On-Prem version 4.3.1-R4 and subsequent versions
• References:
  1. https://www.twcert.org.tw/tw/cp-169-11182-39d2f-1.html

Computer and Communication Center
Network System Division