CVE-2026-109593

CVE Enrichment

CVSS: 9.1 CRITICAL
EPSS: 0.52%
EPSS Percentile: 44.37%
CISA KEV: Not listed

Description

An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 04-Nov-2026 00:17
Last Modified: 04-Nov-2026 03:32
EPSS Date: 2026-11-04
CWE: CWE-636

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:N /
                            A:H

CNA Products / Version Status

SonicWall · Global Management System (GMS) Source: CNA · [email protected]
Default status: unknown

9.5.2 and earlier versions — affected

Platforms: Windows, Linux

References

[email protected]

Last enrichment sync: 05-Nov-2026 02:31
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

The first, CVE-2026-109593, is a critical-severity file read bug that can be exploited without authentication, while the second, CVE-2026-109594, is a medium-severity SQL injection that could allow attackers to access Cisco and WatchGuard Patch Flaws; SonicWall Leaves GMS Bugs Unfixed
The first GMS flaw disclosed this week is tracked as CVE-2026-109593, and it enables unauthenticated attackers with network access to vulnerable instances (running GMS 9.5.2 and earlier versions) to steal sensitive SonicWall Warns of Two Unpatched Flaws in End-of-Life GMS Software

CVE (8)

Vendors (4)

Products (7)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.