MEDIUM CWE-89
CVE-2026-109594
SonicWall Global Management System (GMS) vulnerability
SonicWall·Global Management System (GMS)
6.8/ 10
CVSS 3.1
Medium severity
0.38%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 33% of all CVEs
Not listed
CISA KEV catalog
No confirmed in-the-wild exploitation on CISA's list.
Timeline
- Published
- Nov 3, 2026
- Updated
- Nov 3, 2026
- First covered
- Nov 5, 2026
- Latest story
- 1 week ago
Summary
Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify information stored in the GMS database.
CWE-89Improper neutralization of special elements used in an SQL command ('SQL injection')
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesHigh
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityNone
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:NAffected products
- SonicWall Global Management System (GMS)9.5.2 and earlier versions