What is the CVSS score of EUVD-2026-56945?

EUVD-2026-56945 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of SonicWall GMS are affected by EUVD-2026-56945?

SonicWall Global Management System (GMS) 9.5.1 and earlier contains a critical deserialization vulnerability allowing local attackers with service access to fully compromise system confidentiality,…

How to fix or mitigate EUVD-2026-56945?

Within 24 hours, identify and inventory all SonicWall GMS 9.5.1 (Build 9510.1044 and earlier) systems in your environment, restrict local service access to only essential administrative personnel, and disable remote access to the service if not operationally critical. Within 7 days, implement enhanced monitoring and logging on all affected GMS instances to detect unusual deserialization activity, apply principle of least privilege to all service accounts interacting with GMS, and establish daily log review procedures for suspicious patterns. Within 30 days, contact SonicWall to verify patch timeline and availability, prepare for emergency patching procedures, and evaluate alternative management solutions if GMS cannot be updated within 60 days; maintain offsite backup copies of GMS configuration and data.

SonicWall GMS EUVD-2026-56945

| CVE-2026-18634 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-08-11 sonicwall

GHSA-v8fc-x528-77rr

Deserialization Sonicwall Gms

8.4

CVSS 3.1 · Vendor: sonicwall

Severity by source

Vendor (sonicwall) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local service interaction presupposes a low-privilege local account; PR:L more accurately reflects the local-access prerequisite than the vendor-assigned PR:N.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (sonicwall).

CVSS VectorVendor: sonicwall

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 20:41 vuln.today

CVSS changed

Aug 12, 2026 - 18:22 NVD

8.4 (HIGH)

CVE Published

Aug 11, 2026 - 20:14 cve.org

HIGH 8.4

CVE Published

Aug 11, 2026 - 20:14 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions. A local attacker with the ability to interact with the service could exploit this behavior to perform unauthorized actions through the affected component.

AnalysisAI

Insecure deserialization in SonicWall Global Management System (GMS) 9.5.1 (Build 9510.1044) and earlier enables a local attacker who can interact with the affected service to perform unauthorized actions resulting in full compromise of confidentiality, integrity, and availability. The root cause is CWE-502: the service deserializes attacker-controlled objects without adequate validation, allowing manipulation of application logic or execution of unintended code paths. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS places exploitation probability in the 18th percentile, indicating low current exploitation interest despite a high CVSS score.

Technical ContextAI

CWE-502 (Deserialization of Untrusted Data) arises when an application reconstructs objects from a serialized byte stream supplied by an untrusted source without first validating or sanitizing the data, enabling gadget-chain attacks or logic manipulation that the application framework never intended to permit. SonicWall GMS (Global Management System) is a centralized web-based management platform used by enterprises to configure, monitor, and manage fleets of SonicWall network security appliances. The affected component is one of the GMS application's internal services. Per CPE cpe:2.3:a:sonicwall:gms:*:*:*:*:*:*:*:*, all GMS versions up to and including 9.5.1 (Build 9510.1044) are within scope. The attack vector is local, meaning the service interface receiving the malicious serialized object must be reachable from the local host rather than over a network.

RemediationAI

The primary remediation is to upgrade SonicWall GMS beyond version 9.5.1 (Build 9510.1044); consult the SonicWall PSIRT advisory at https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011 directly for the exact patched build number, as a specific fixed version was not disclosed in the available intelligence data. If immediate patching is not feasible, restrict interactive and service-level local access to the GMS host to the minimum necessary administrative accounts, removing shell access for any untrusted or shared local users - this directly eliminates the local-access prerequisite. Additionally, review and tighten OS-level permissions on the socket or IPC mechanism used by the vulnerable service so that only the GMS application's own service account can submit data to it; this adds a compensating control without requiring downtime, though it may complicate legitimate administrative workflows. Disabling the specific affected GMS service component, if identifiable through vendor guidance, is a more targeted option but risks degrading management functionality.