EUVD-2026-56939
GHSA-4hvc-qq88-xc6c
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered XSS requiring victim interaction to trigger; attacker needs no credentials; scope changes to victim browser context; no server availability impact.
Primary rating from Vendor (sonicwall).
CVSS VectorVendor: sonicwall
Lifecycle Timeline
1DescriptionCVE.org
Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote attacker to execute javascript script in a user's browser.
AnalysisAI
Multiple XSS vulnerabilities in SonicWall Global Management System (GMS) 9.5.1 and earlier allow unauthenticated remote attackers to execute arbitrary JavaScript in authenticated users' browsers. The Changed scope (S:C) in the CVSS vector confirms injected scripts run in the victim browser's security context - not the server - enabling session hijacking, credential theft, or phishing overlays targeting GMS administrators. No public exploit code exists and no CISA KEV listing is present at time of analysis; SSVC classifies exploitation as none.
Technical ContextAI
SonicWall Global Management System (GMS) is an enterprise-grade centralized management platform for SonicWall network security appliances, commonly deployed by managed security service providers and enterprise IT teams. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as the application's failure to sanitize or encode user-supplied input before rendering it in HTML output. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:C is consistent with reflected XSS - where an attacker crafts a malicious URL targeting a vulnerable GMS parameter - or stored XSS, where a payload persists server-side and fires when any authenticated user views the affected page. The Changed scope metric is technically significant: it means the injected script executes under the victim's browser origin rather than the GMS server origin, enabling cross-context data access including session tokens.
RemediationAI
Apply the vendor-supplied fix documented in SonicWall PSIRT advisory SNWLID-2026-0011, available at https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011. An exact patched version number was not specified in the available source data; the advisory must be consulted directly to confirm the target upgrade version. As a compensating control while patching, restrict access to the GMS administrative web interface to trusted internal networks or VPN-only segments using perimeter firewall rules - this eliminates the network attack surface for reflected XSS delivery. Additionally, enforce a policy requiring GMS administrators to access the portal only via bookmarked URLs rather than following external links, reducing phishing-based delivery risk. These controls reduce but do not eliminate exposure and are not a substitute for patching.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today