EUVD-2026-56945
GHSA-v8fc-x528-77rr
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local service interaction presupposes a low-privilege local account; PR:L more accurately reflects the local-access prerequisite than the vendor-assigned PR:N.
Primary rating from Vendor (sonicwall).
CVSS VectorVendor: sonicwall
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions. A local attacker with the ability to interact with the service could exploit this behavior to perform unauthorized actions through the affected component.
AnalysisAI
Insecure deserialization in SonicWall Global Management System (GMS) 9.5.1 (Build 9510.1044) and earlier enables a local attacker who can interact with the affected service to perform unauthorized actions resulting in full compromise of confidentiality, integrity, and availability. The root cause is CWE-502: the service deserializes attacker-controlled objects without adequate validation, allowing manipulation of application logic or execution of unintended code paths. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to have local access to the operating system hosting the GMS application and the ability to directly interact with the specific vulnerable internal service - for example, via a local shell, a shared terminal session, or equivalent OS-level access to the service's communication interface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Weighing the available signals reveals a nuanced picture: the CVSS base score of 8.4 and 'total' technical impact rating from SSVC suggest severe consequences if exploited, yet the local attack vector (AV:L) materially constrains who can realistically mount an attack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained a local shell account on the GMS host - whether through a prior compromise, an insider threat, or misconfigured shared access - identifies the vulnerable internal GMS service and crafts a malicious serialized Java or .NET object embedding a gadget chain. Submitting this payload to the service causes it to deserialize the object and invoke unintended methods, resulting in unauthorized actions such as arbitrary code execution under the service's security context with high impact across confidentiality, integrity, and availability. … |
| Remediation | The primary remediation is to upgrade SonicWall GMS beyond version 9.5.1 (Build 9510.1044); consult the SonicWall PSIRT advisory at https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011 directly for the exact patched build number, as a specific fixed version was not disclosed in the available intelligence data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all SonicWall GMS 9.5.1 (Build 9510.1044 and earlier) systems in your environment, restrict local service access to only essential administrative personnel, and disable remote access to the service if not operationally critical. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in SonicWall Global Management System (GMS) 9.5.1 and earlier is possible through an unauthenticat
Insufficient certificate validation in SonicWall Global Management System (GMS) 9.5.1 (Build 9510.1044) and earlier expo
Command injection in SonicWall Global Management System (GMS) CLI version 9.5.1 and earlier enables a low-privileged use
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today