SonicWall GMS CVE-2026-109594

Requires authenticated, high-privilege access to the SonicWall GMS management interface (CVSS PR:H), and applies only to the End-of-Life GMS 9.5.2 and earlier branch. The vendor further limits exploitation to unspecified 'specific conditions,' and the exact triggering parameter, feature, or configuration is not described in the available sources. Limiting factors: attacker must already possess elevated GMS credentials, the affected product is a specific vendor management platform, and exploitation is conditional rather than guaranteed against all deployments.

This is a moderate-severity issue (CVSS 6.8) whose real-world priority is tempered by its access requirements. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N indicates network reach but requires high privileges (PR:H), making this a post-authentication flaw exploitable only by an actor who already holds elevated GMS credentials. No EPSS score was provided, the CVE is not listed in CISA KEV, and no public exploit or PoC reference is present in the input, so there is no evidence of active exploitation or available exploit code. The vendor's own prioritization is 'this_month' rather than act_now/emergency, consistent with a medium-risk, insider-or-post-compromise issue rather than a mass-exploitable perimeter bug. One conflict should be verified with the vendor: the CVSS vector sets I:N (no integrity impact), yet the description explicitly says an attacker could 'access or modify information' - 'modify' implies integrity impact, so the published I:N appears understated. The product is also End-of-Life (GMS 9.5.2 and earlier), which raises residual risk because a complete fix may require migrating off the EOL line rather than patching in place; no fixed version is given in the available data.

An attacker who already holds high-privilege authenticated access to the SonicWall GMS management interface submits crafted input to a vulnerable parameter, injecting SQL that reads or alters data in the GMS database. Exploitation is further gated by unspecified 'specific conditions' the vendor references but does not detail. No public exploit code or PoC reference is identified in the available data.