External risk intelligence

SonicWall NSM On-Prem Zip Slip Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-81939

SonicWall NSM is a centralized management platform often deployed with interfaces reachable for administration. Because the vulnerability exists within file upload and archive processing functions—features typically exposed to facilitate management tasks—the attack surface is considered likely to be externally accessible.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability identified in SonicWall's Network Security Manager (NSM) On-Prem software. The issue involves improper handling of uploaded archives, which could allow unauthorized file extraction outside of designated areas. This type of vulnerability, known as Zip Slip, poses a significant risk as it may enable malicious actors to overwrite or access critical system files. The main concern is confirming if your deployed NSM instances are potentially exposed and what the scope of impact might be.

Malicious archives can overwrite critical files.
Essential to confirm if NSM is exposed.
Assess and address potential security risks.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by uploading a malicious archive file to the SonicWall Network Security Manager (NSM) On-Prem. This specially crafted archive, when processed by the NSM's file upload and archive handling, could allow the attacker to place files in unintended locations on the system. This capability, if leveraged effectively, could lead to significant compromise of the affected system.

Requires authenticated access to upload files.
Triggered by processing a crafted archive.
Risk of unauthorized file access or modification.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to overwrite or replace system files when processing a crafted archive through the SonicWall Network Security Manager's file upload functionality. This could potentially impact the integrity and availability of the management service itself.

System file integrity.
Malicious archive upload.
Service disruption or compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This Zip Slip vulnerability in SonicWall Network Security Manager's file upload functionality requires immediate attention from teams managing network security infrastructure. The first practical step is to identify all NSM instances, determine their exposure, and confirm business criticality to prioritize remediation efforts.

Infrastructure and Security teams should own this.
Verify NSM instance exposure and criticality.
Plan and coordinate remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SonicWall Network Security Manager (NSM) On-Prem?

SonicWall NSM On-Prem is a centralized management platform used by IT teams to oversee and configure various network security devices from a single interface. It handles administrative tasks, including file uploads and archive processing, which are essential for maintaining and updating the security infrastructure.

What does Zip Slip mean for CVE-2026-81939?

This vulnerability is classified as CWE-22, or Improper Limitation of a Pathname to a Restricted Directory. In simple terms, the software fails to properly check file paths within an uploaded archive. This allows a specifically formatted file to 'slip' out of its intended folder and write data to unauthorized or critical locations on the system.

How is this vulnerability triggered?

The issue is triggered when an attacker uploads a malicious archive file through the NSM's processing functionality. Simply having an NSM instance is not enough; the attacker must successfully upload and force the system to process the crafted archive. Standard operations or legitimate file uploads do not trigger this flaw.

Is my NSM instance at risk?

Halo Surface Signal indicates that because NSM is a management platform, its administrative interfaces are often reachable over a network. Since this bug exists in file upload features typically accessible to administrators, the risk is higher if your management portal is exposed externally rather than restricted to internal, trusted networks.

What should I do to secure my environment?

Begin by identifying all deployed NSM instances across your infrastructure and documenting their specific network accessibility. Verify the criticality of each instance to prioritize your response. Monitor official communications from the vendor for available updates or configuration changes to mitigate the file handling risk.

References

psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0015

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.