Loading story…
Attackers sharply increased exploitation attempts against SonicWall Global Management System (GMS) in October, targeting the SQL injection flaw CVE-2023-34133 to bypass authentication and extract sensitive data from SGMS databases. Mitsui Bussan Secure Directions reported that its SOC had seen intermittent activity since the vulnerability was disclosed, but detections rose notably as public proof-of-concept exploit code circulated. The observed attacks primarily originated from the United States, with additional traffic from France and Germany.
The vulnerability affects SonicWall GMS 9.3.2-SP1 and earlier and SonicWall Analytics 2.5.0.4-R7 and earlier, according to SonicWall's advisory SNWLID-2023-0010. MBSD said the exploit traffic included HTTP GET requests using UNION SELECT payloads designed to enumerate domain IDs and retrieve active user credentials from the SGMS database, creating a risk of administrative compromise and data theft. Organizations running exposed instances were urged to update to the latest fixed versions immediately.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
MBSD-SOC reported a notable rise in detections during October 2024 involving exploitation attempts against SonicWall GMS via CVE-2023-34133. The observed activity included SQL injection requests aimed at extracting domain IDs and active user credentials from the SGMS database.
The SonicWall GMS SQL injection vulnerability CVE-2023-34133 was publicly disclosed in July 2023. The flaw can enable remote authentication bypass and theft of sensitive information.
MITRE published the CVE record for CVE-2023-34133, covering an SQL injection vulnerability affecting SonicWall Global Management System.
After the July 2023 disclosure, MBSD-SOC observed intermittent attacks targeting CVE-2023-34133. The article also notes that proof-of-concept exploit code had become publicly available.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SonicWall has released patches for eight vulnerabilities affecting its **Global Management System (GMS)** and **Email Security** products, including critical flaws that could enable remote code execution. The most severe issues, tracked as **`CVE-2026-66147`** and **`CVE-2026-66145`**, impact **GMS 9.5.1 and earlier** on both Windows and Linux. SonicWall said the GMS issues were fixed in **version 9.5.2**, while Email Security vulnerabilities were addressed in **version 10.0.36**. `CVE-2026-66147` is described as an unauthenticated command injection flaw in the GMS Dispatcher Service that can allow remote attackers to execute arbitrary code via crafted requests. `CVE-2026-66145` affects the discontinued GMS platform and can allow unauthenticated attackers to achieve remote code execution, read sensitive data, and perform arbitrary file writes through a **Zip Slip** condition. SonicWall said it has **no evidence of in-the-wild exploitation**, but the vulnerabilities carry high technical impact and customers were urged to update promptly.
Aug 12, 2026
SonicWall disclosed four vulnerabilities in **Secure Mobile Access (SMA) 1000** series appliances that could allow **SQL injection-based privilege escalation**, **unauthenticated user credential enumeration**, and **multi-factor authentication bypass**. The issues affect SMA 1000 deployments through flaws in SQL handling and Unicode processing, with the most severe bug tracked as **`CVE-2026-4112`** and rated **CVSS 7.2**. SonicWall said the vulnerabilities do **not** impact SSL-VPN functionality on standard SonicWall firewalls. According to SonicWall's advisory **`SNWLID-2026-0003`**, the Unicode-related flaws can bypass **TOTP** protections in **AMC**, **Workplace**, or **Connect Tunnel** authentication flows, increasing the risk of unauthorized access. SonicWall said it has **no evidence of active exploitation** and provided **hotfixes and fixed releases** for affected SMA 1000 versions, adding that **no workarounds or alternative mitigations are available**, making patching the required response for exposed systems.
Jun 29, 2026
SonicWall disclosed multiple vulnerabilities affecting **Email Security** and **GMS**, prompting a Canadian Centre for Cyber Security advisory urging administrators to review vendor guidance and apply updates. The affected products include **SonicWall Email Security 10.0.35.8405 and earlier** and **SonicWall GMS 9.5.1 and earlier**. The Cyber Centre said the issues were current as of August 11 and advised organizations to deploy fixes as they become available. For **SonicWall Email Security**, SonicWall identified two authenticated code injection flaws, **`CVE-2026-66149`** and **`CVE-2026-66150`**, each rated **CVSS 7.8**, that could let a user with access to the restricted CLI inject arbitrary OS commands as **root** through the **netmask** and **SNMP** vectors. Separately, **`CVE-2026-66154`** affects **SonicWall GMS on Linux** and stems from **insufficient certificate validation** in a privileged communication workflow, creating a man-in-the-middle path to unauthorized changes under controlled network conditions. SonicWall said it had **no evidence of in-the-wild exploitation** for the Email Security flaws and directed customers to upgrade to fixed releases.
Aug 14, 2026