Description
Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify information stored in the GMS database.
Published: 2026-11-03
Score: 6.8 Medium
EPSS: n/a
KEV: No
Impact: SQL injection that allows data access or modification
Action: Upgrade or Disable
AI Analysis

Impact

This vulnerability is a post‑authentication SQL injection that lets an attacker with valid credentials execute arbitrary SQL statements in the GMS database, potentially exposing or altering sensitive information.

Affected Systems

SonicWall Global Management System (GMS) 9.5.2 and all earlier releases, all of which are end‑of‑life and no longer supported.

Risk and Exploitability

The exploit requires a valid user account on the GMS web interface; once authenticated the attacker can inject malicious SQL through a vulnerable input field. Because the affected versions are out of support, patching is not available, leaving the exposure vulnerable for anyone who has valid credentials. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the potential for data modification makes the risk high.

Generated by OpenCVE AI on November 3, 2026 at 17:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a supported SonicWall GMS version or replace the product with a supported alternative.
  • Restrict access to the GMS web interface to trusted networks and enforce least privilege on user accounts.
  • If upgrading is not immediately possible, isolate or disable the affected functionality and block external access to the database port, and consider deploying a web application firewall to block suspicious SQL payloads.

Generated by OpenCVE AI on November 3, 2026 at 17:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 03 Nov 2026 17:45:00 +0000

Type Values Removed Values Added
Title Post‑Authentication SQL Injection in SonicWall Global Management System 9.5.2 and Earlier Allowing Data Access or Modification

Tue, 03 Nov 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N'}

Tue, 03 Nov 2026 16:30:00 +0000

Type Values Removed Values Added
Description Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify information stored in the GMS database.
Weaknesses CWE-89
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: sonicwall

Published:

Updated: 2026-11-03T17:05:42.163Z

Reserved: 2026-10-12T20:55:20.613Z

Link: CVE-2026-109594

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-03T17:17:53.917

Modified: 2026-11-03T17:17:53.917

Link: CVE-2026-109594

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-03T17:30:08Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')