SonicWall NSM On-Prem Affected By Multiple Vulnerabilities
SNWLID-2026-0018
Summary
1) CVE-2026-109593 - End-of-Life (EOL) SonicWall GMS Unauthenticated File Read Vulnerability
An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information.
CVSS Score: 9.1
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CWE-636: Not Failing Securely ('Failing Open')
2) CVE-2026-109594 - End-of-Life (EOL) SonicWall GMS Authenticated SQL Injection Vulnerability
Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify information stored in the GMS database.
CVSS Score: 6.8
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Products covered
GMS - Virtual Appliance and Windows: 9.5.2 and earlier versions
Remediation
Install the applicable fixed SonicWall release for your product and branch.
Vendor-listed fixes
Fixed Product(s): Fixed Versions
GMS - Virtual Appliance and Windows: A fix version is not available as the product has reached End-of-Life (EOL).
CVEs in this advisory 2
Updates
- Published by SonicWall
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.