Loading vulnerability…
Post-authentication SQL Injection in SonicWall GMS
CVE-2026-109594 is a post-authentication SQL injection vulnerability affecting end-of-life SonicWall Global Management System (GMS) 9.5.2 and earlier, including Virtual Appliance and Windows deployments. Improper neutralization of special elements in SQL commands could allow a highly privileged authenticated attacker to access or modify information stored in the GMS database under specific conditions. The affected function and additional exploitation conditions have not been disclosed. The vulnerability has a CVSS v3.1 base score of 6.8.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could expose sensitive information stored in the GMS database and potentially permit database information to be modified. Although the vulnerability description includes potential modification, its published CVSS vector assigns high confidentiality impact and no integrity or availability impact.
If you can’t patch tonight, do this now.
No vendor workaround is available. Interim risk-reduction measures include restricting GMS access to trusted administrators and management networks, minimizing privileged accounts, and isolating the end-of-life deployment. These measures do not eliminate the underlying vulnerability.
Patch, then assume compromise.
Migrate affected deployments to SonicWall Network Security Manager (NSM) and retire the vulnerable GMS instances. GMS has reached end of life, and SonicWall states that no fixed version or security update will be released.
No public exploits tracked yet. Mallory keeps watching.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.