CVE-2026-78328: CWE-862 Missing Authorization in SonicWall Network Security Manager (NSM)

This vulnerability (CVE-2026-78328) in SonicWall Network Security Manager (NSM) is classified as CWE-862 (Missing Authorization). It enables a lower-privileged Admin user to escalate their privileges to SuperAdmin via the On-Prem Management interface. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. The vendor has not provided patch or remediation details, and the product is not a cloud service, so remediation depends on vendor advisories.

Successful exploitation allows a lower-privileged Admin user to gain SuperAdmin privileges, which can lead to full control over the NSM system. This compromises confidentiality, integrity, and availability of the network security management environment. The vulnerability poses a critical risk to organizations using affected SonicWall NSM versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict lower-privileged Admin access and monitor for suspicious privilege escalation attempts. Follow SonicWall advisories closely for updates.