Live › vulnerability › CVE-2026-109594
SonicWall GMS 9.5.2 and earlier, which is end-of-life, has an SQL injection flaw reachable after login. An authenticated attacker can access or modify information stored in the GMS database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
Organizations running SonicWall GMS 9.5.2 or earlier are exposed, and the product is end-of-life so no upgrade path is stated in the sources. Exploitation needs a valid GMS login and specific conditions the sources do not detail. Teams on newer GMS releases are outside the stated range.
No product ranges from the sources yet.
9.5.2 and earlier) in the GMS console or install directoryNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify information stored in the GMS database.
This page as .md · .json · in your agent: get_signal("CVE-2026-109594")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.