CVE-2026-109594
MediumCVSS 6.8Summary
Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify information stored in the GMS database.
Risk Assessment
An authenticated attacker may read or modify data in the GMS database, potentially compromising data confidentiality and integrity. Since the product is End-of-Life, it will not receive security patches.
Recommendation
Plan migration from SonicWall GMS to a supported product or version. Until migration, restrict access to the GMS interface to trusted networks and users, and monitor database activity.
Other vulnerabilities in SonicWall GMS
Original NVD description (English source)
Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify information stored in the GMS database.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS