CVE-2026-109594 PUBLISHED

Assigner: sonicwall
Reserved: 12.10.2026 Published: 03.11.2026 Updated: 03.11.2026

Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify information stored in the GMS database.

Product Status

Vendor SonicWall
Product Global Management System (GMS)
Versions Default: unknown
  • Version 9.5.2 and earlier versions is affected

Credits

  • Matei 'Mal' Badanoiu and Andrei Lungu of Pentest-Tools.com finder

References

Problem Types

  • CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection') CWE