EUVD-2026-116040
GHSA-w3p9-mvmw-xhwm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to GMS with high privileges
-
ExploitSubmit crafted SQL in request parameter
-
ExecutionInjected query runs against GMS database
-
ImpactRead or modify stored database information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated, high-privilege access to the SonicWall GMS management interface (CVSS PR:H), and applies only to the End-of-Life GMS 9.5.2 and earlier branch. The vendor further limits exploitation to unspecified 'specific conditions,' and the exact triggering parameter, feature, or configuration is not described in the available sources. Limiting factors: attacker must already possess elevated GMS credentials, the affected product is a specific vendor management platform, and exploitation is conditional rather than guaranteed against all deployments. |
| Impact | This is a moderate-severity issue (CVSS 6.8) whose real-world priority is tempered by its access requirements. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N indicates network reach but requires high privileges (PR:H), making this a post-authentication flaw exploitable only by an actor who already holds elevated GMS credentials. No EPSS score was provided, the CVE is not listed in CISA KEV, and no public exploit or PoC reference is present in the input, so there is no evidence of active exploitation or available exploit code. The vendor's own prioritization is 'this_month' rather than act_now/emergency, consistent with a medium-risk, insider-or-post-compromise issue rather than a mass-exploitable perimeter bug. One conflict should be verified with the vendor: the CVSS vector sets I:N (no integrity impact), yet the description explicitly says an attacker could 'access or modify information' - 'modify' implies integrity impact, so the published I:N appears understated. The product is also End-of-Life (GMS 9.5.2 and earlier), which raises residual risk because a complete fix may require migrating off the EOL line rather than patching in place; no fixed version is given in the available data. |
| Exploit ScenarioDerived | An attacker who already holds high-privilege authenticated access to the SonicWall GMS management interface submits crafted input to a vulnerable parameter, injecting SQL that reads or alters data in the GMS database. Exploitation is further gated by unspecified 'specific conditions' the vendor references but does not detail. No public exploit code or PoC reference is identified in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
SQL injection in the End-of-Life SonicWall Global Management System (GMS) 9.5.2 and earlier allows an attacker who already holds high-privilege credentials on the GMS management interface to read or modify data held in the GMS database. The vendor restricts practical exploitation to unspecified 'specific conditions', and the exact vulnerable parameter or feature is not described in the available sources; no public exploit is identified at time of analysis and the issue is not reported as actively exploited. With CVSS 6.8 and a this_month prioritization label, the practical exposure is concentrated in organizations still running the unsupported 9.5.x branch rather than in the general internet-facing population.
RemediationAI
No patch for the 9.5.2-and-earlier branch is identified in the available data, consistent with the vendor's End-of-Life status for that release line: the effective remediation is to migrate off GMS 9.5.x to a currently supported SonicWall GMS release or an equivalent supported management platform, following the vendor advisory SNWLID-2026-0019 (https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0019) for the supported target and migration path. Where migration cannot be completed immediately, compensating controls should target the prerequisite the attacker must satisfy - high-privilege access to the GMS management interface: restrict reachability of the GMS console to a dedicated administrative network or VPN rather than the public internet, enforce least-privilege and MFA-backed accounts on GMS, and audit administrative accounts and database activity for unexpected reads or modifications, accepting that these reduce but do not eliminate exposure while the unsupported platform remains in service.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-89 improper neutralization of special elements in an SQL command, i.e. SQL injection, in SonicWall Global Management System - the vendor's central management console for deploying and monitoring SonicWall firewalls and related security appliances. Because GMS aggregates configuration and reporting data for managed devices, its backing database is a high-value target. The CPE identifies the affected product family as sonicwall:global_management_system_(gms) with no version binding, and the EUVD entry pins the affected range to GMS 9.5.2 and earlier, a branch the vendor has declared End-of-Life. The independently assessed vector (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N) indicates the attack path is network-reachable but requires high privileges and conditions that make success non-trivial; it differs from the vendor's published vector (AC:L, S:C, C:H/I:N/A:N) chiefly in complexity, scope and integrity impact, so the confidentiality and integrity of the GMS database should both be considered at risk. The trigger mechanism - which request, parameter, or GMS feature is susceptible - is not described in the available sources.
Know when Global Management System Gms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Network-reachable web UI (AV:N) but gated by vendor 'specific conditions' (AC:H) and high-privilege auth (PR:H); SQLi can read and alter DB data (C:H/I:H), so I raised integrity over the published I:N.
Primary rating from Vendor (sonicwall).
CVSS VectorVendor: sonicwall
Lifecycle Timeline
2DescriptionCVE.org
Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify information stored in the GMS database.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB