SonicWall GMS CVE-2026-109593

No special feature or configuration prerequisite is named in the sources: the advisory describes unauthenticated network access to a SonicWall GMS 9.5.2 (or earlier) instance resulting in disclosure of internal GMS files, consistent with AV:N/AC:L/PR:N/UI:N against a reachable deployment. The primary limiting factor is version: only GMS 9.5.2 and earlier are listed as affected, so patched/newer branches are out of scope. Exploitation further requires network reachability to the GMS management interface - instances restricted to internal management networks or behind access controls are substantially less exposed than internet-facing ones. The exact file(s) or endpoint that trigger disclosure are not described in the available sources.

Signals point in different directions and net out to a moderate, watch-list priority rather than an emergency. The input CVSS base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H), which on raw severity looks critical and reflects unauthenticated, low-complexity network reach. However, the vuln.today Decision label is 'monitor' and the CISA SSVC framework records Exploitation: none, Automatable: yes, Technical Impact: partial - i.e. no observed or expected exploitation and only partial impact, which is consistent with an information-read flaw rather than full system compromise. No EPSS score is provided, so exploitation probability cannot be quantified from this data. The CVE is not listed in CISA KEV and no exploit or PoC reference appears in the input, so exploitation status is 'no public exploit identified at time of analysis.' A notable internal conflict exists: the description characterizes this purely as reading internal files (a confidentiality issue), yet the supplied CVSS vector sets A:H (high availability impact) while I:N - the availability metric is not explained by the described mechanism and should be verified with the vendor; the SSVC 'partial' technical impact aligns better with confidentiality-only disclosure. Net: a genuinely high-reach confidentiality exposure worth remediating, but current decision signals (monitor, no KEV, no PoC, SSVC exploitation none) do not indicate active, widespread exploitation.

An attacker with network reach to an exposed SonicWall GMS 9.5.2 (or earlier) instance sends requests that cause the application to disclose internal GMS files, returning their contents without authentication. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special timing are required, and SSVC marks the flaw Automatable:yes, so retrieval could be scripted across reachable hosts. No public exploit or PoC is identified in the available sources at time of analysis.