{"id":231,"created_when":"2026-11-03T08:16:31Z","created_by":"arun","updated_when":"2026-11-03T08:16:31Z","updated_by":"arun","advisory_id":"SNWLID-2026-0019","title":"End-Of-Life (EOL) SonicWall GMS Multiple Vulnerabilities","published_when":"2026-11-03T08:16:31Z","last_updated_when":"2026-11-03T08:16:31Z","impact":"critical","cvss":"9.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","cvss_version":3.0,"cwe":"CWE-636, CWE-89","cve":"CVE-2026-109593, CVE-2026-109594","cpe":"","summary":"

1) CVE-2026-109593 - End-of-Life (EOL) SonicWall GMS Unauthenticated File Read Vulnerability

An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information.

CVSS Score: 9.1
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
\t\t\r\nCWE-636: Not Failing Securely ('Failing Open')

\r\n\r\n

2) CVE-2026-109594 - End-of-Life (EOL) SonicWall GMS Authenticated SQL Injection Vulnerability

Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify information stored in the GMS database.

CVSS Score: 6.8
\r\nCVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

","is_workaround_available":false,"workaround":"None.","detail":"Important: The affected product has reached End-of-Life (EOL). As a result, no remediation or security update will be released for these vulnerabilities. Organizations using the product should be aware of the associated security risks and are strongly encouraged to upgrade to the SonicWall Network Security Manager (NSM).","affected_products":"

Affected Product

Affected Version(s)

GMS - Virtual Appliance and Windows 

9.5.2 and earlier versions


","fixed_software":"\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n
\r\n

Fixed Product(s)

\r\n 		\r\n

 Fixed Versions

\r\n
\r\n

GMS - Virtual Appliance and Windows 
\r\n

\r\n 		\r\n

A fix version is not available as the product has reached End-of-Life (EOL).

\r\n
","credits":"


\r\n \r\n \r\n \r\n

Vulnerabilities

\r\n 		\r\n

Reported By

\r\n
CVE-2026-109593Matei 'Mal' Badanoiu of Pentest-Tools.com 
CVE-2026-109594Matei 'Mal' Badanoiu and Andrei Lungu of Pentest-Tools.com
","revision_history":"\r\n\r\n","references":"","vuln_status":"Applicable","status":"published","is_published":true,"patterns":[],"vulnerable_products":[{"id":19,"name":"Global Management System (GMS)"}]}