Security readout for executives and security teams
Plain-English summary
A lower-privileged NSM administrator can reportedly obtain SuperAdmin authority, potentially gaining full control of managed security operations. The issue affects SonicWall Network Security Manager On-Prem 4.3.0 and earlier. Although exploitation requires an authenticated administrative account, the resulting confidentiality, integrity, and availability impact could be severe.
Executive priority
Treat this as an urgent privileged-access issue. Rapidly inventory affected NSM systems, follow SonicWall remediation guidance, and investigate suspicious administrator changes. Prioritize deployments managing critical firewalls or reachable from less-trusted administrative networks, while recognizing that the supplied evidence does not show active exploitation.
Technical view
CVE-2026-78328 is a missing-authorization flaw (CWE-862) in the NSM On-Prem Management interface. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, indicating network access, low complexity, existing high privileges, no user interaction, changed scope, and potentially high impact across all three security objectives.
Likely exposure
Exposure is limited to organizations running NSM On-Prem 4.3.0 or earlier where an authenticated lower-privileged Admin can reach the management interface. The bundle does not establish whether the interface is internet-accessible by default or whether cloud-hosted NSM is affected.
Exploitation context
The supplied record does not establish active exploitation, and the CVE is not identified as being in KEV. Exploitation reportedly requires an existing lower-privileged Admin account, making compromised, malicious, or improperly assigned administrative access the primary concern. No public exploit details are established by the supplied evidence.
Researcher notes
The record identifies CWE-862 but provides no endpoint-level authorization details, patch version, workaround, or exploitation telemetry. The apparent tension between “lower-privileged Admin” and CVSS PR:H reflects an already privileged attacker escalating to SuperAdmin. Researchers should avoid inferring affected hosted offerings or versions beyond NSM On-Prem 4.3.0 and earlier.
Mitigation direction
- Identify every NSM On-Prem deployment and confirm its installed version.
- Review the SonicWall advisory for fixed-version or mitigation guidance and apply it promptly.
- Restrict management-interface access to trusted administrative networks and authorized personnel.
- Remove unnecessary Admin accounts and reduce privileges where operationally feasible.
- Monitor SonicWall guidance for revisions because the vulnerability was recently published.
Validation and detection
- Verify that no NSM On-Prem instance remains on version 4.3.0 or earlier after remediation.
- Review administrator accounts, assigned roles, and recent privilege changes for anomalies.
- Examine management and authentication logs for unexpected SuperAdmin activity.
- Confirm network controls limit management-interface access to approved sources.
- After remediation, test that lower-privileged Admin accounts cannot perform SuperAdmin-only actions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-78328 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H2.36CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0015CVE reference, sonicwall · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.