CVE-2026-109594

CVE Enrichment

CVSS: 6.8 MEDIUM
EPSS: 0.38%
EPSS Percentile: 32.26%
CISA KEV: Not listed

Description

Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify information stored in the GMS database.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 04-Nov-2026 00:17
Last Modified: 04-Nov-2026 03:32
EPSS Date: 2026-11-04
CWE: CWE-89

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:H /
                            UI:N /
                            S:C /
                            C:H /
                            I:N /
                            A:N

CNA Products / Version Status

SonicWall · Global Management System (GMS) Source: CNA · [email protected]
Default status: unknown

9.5.2 and earlier versions — affected

Platforms: Windows, Linux

References

[email protected]

Last enrichment sync: 05-Nov-2026 02:34
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

is a critical-severity file read bug that can be exploited without authentication, while the second, CVE-2026-109594, is a medium-severity SQL injection that could allow attackers to access and modify information in Cisco and WatchGuard Patch Flaws; SonicWall Leaves GMS Bugs Unfixed
SonicWall also flagged a second security issue (CVE-2026-109594) that can let threat actors with high privileges access or modify information stored in the GMS database through low-complexity SQL Injection attacks. SonicWall Warns of Two Unpatched Flaws in End-of-Life GMS Software

CVE (8)

Vendors (4)

Products (7)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.