EUVD-2026-56943
GHSA-5h7r-wrwv-5rj5
Severity by source
AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Adjacent vector and high complexity reflect the required MitM positioning on the management segment; scope change captures total impact on managed appliances beyond the GMS host.
Primary rating from Vendor (sonicwall).
CVSS VectorVendor: sonicwall
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions which, under a successful MitM attack and controlled network conditions, could permit unauthorized changes.
AnalysisAI
Insufficient certificate validation in SonicWall Global Management System (GMS) 9.5.1 (Build 9510.1044) and earlier exposes a privileged internal communication workflow to man-in-the-middle interception, enabling an attacker with adjacent network access to present a fraudulent certificate the application accepts without proper verification. Under controlled network conditions allowing a successful MitM position, an unauthenticated attacker (per CVSS PR:N) can read, modify, or inject data into what GMS treats as a trusted management channel, resulting in unauthorized configuration changes that propagate to managed SonicWall infrastructure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be physically or logically positioned on the same network segment as the SonicWall GMS privileged communication workflow (AV:A) - remote internet-based attackers cannot exploit this directly. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.3 base score and S:C scope change reflect the breadth of downstream impact once exploitation succeeds across managed appliances, but two CVSS metrics substantially constrain real-world exploitability: AV:A limits the attacker to the same network segment as the GMS privileged communication traffic, and AC:H requires a successful MitM position under controlled network conditions - neither prerequisite is trivially satisfied in properly segmented enterprise environments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with access to the same network segment as SonicWall GMS management traffic deploys a MitM tool - such as ARP spoofing combined with a rogue TLS endpoint presenting a self-signed certificate - to intercept the privileged GMS communication workflow. Because GMS fails to properly validate the presented certificate (CWE-295), the forged credential is accepted and the attacker gains transparent access to the management channel, allowing injection of unauthorized configuration commands. … |
| Remediation | The primary remediation is to upgrade SonicWall GMS to a version beyond 9.5.1 (Build 9510.1044) per SonicWall PSIRT advisory SNWLID-2026-0011, available at https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011; the advisory should be consulted directly for the specific patched release version, as an exact fix version number is not independently confirmed in currently available intelligence. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running SonicWall GMS 9.5.1 (Build 9510.1044) or earlier and restrict administrative network access to this system to trusted internal networks only-do not expose GMS to untrusted segments or the internet. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in SonicWall Global Management System (GMS) 9.5.1 and earlier is possible through an unauthenticat
Insecure deserialization in SonicWall Global Management System (GMS) 9.5.1 (Build 9510.1044) and earlier enables a local
Command injection in SonicWall Global Management System (GMS) CLI version 9.5.1 and earlier enables a low-privileged use
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today