A master-keyed janitor finds an unpatched duct into the building's security blueprint room
CVE-2026-109594 is a post-authentication SQL injection in SonicWall Global Management System (GMS) 9.5.2 and earlier. Once an attacker has a valid high-privilege GMS account, they can submit crafted input to an unspecified management interface parameter that reaches a SQL query, allowing them to read arbitrary data from the backend database. The affected product is end-of-life, and no fixed version exists.
SonicWall's MEDIUM 6.8 rating reflects the PR:H requirement, but it misses the central role of GMS: a compromised GMS database can expose credentials and configuration data for managed SonicWall firewalls, turning a single authenticated read into a fleet-wide pivot. With no patch available for EOL software, the practical severity is higher than the vendor number suggests.
5 steps from start to impact.
Obtain a valid high-privilege GMS account
- Valid GMS administrator username/password or session token
- Network access to the GMS management interface
- GMS should not be reachable from the internet
- MFA on admin accounts can block reused/phished credentials if enforced
Authenticate to the GMS web console
- Successful admin session established
- Access to the vulnerable URL/parameter
- Internal segmentation or jump hosts may restrict access
- Session timeouts and MFA re-auth reduce persistence
Identify the injectable parameter
- Ability to make requests to vulnerable endpoint
- Knowledge of the application parameter
- No public PoC; exploit development effort needed
- WAF may flag SQL metacharacters
' OR 1=1 style payloads.Inject malicious SQL to read database contents
- Backend database accepts injected syntax
- No prepared statements or effective input validation
- Privilege context of DB user may limit some tables
- WAF/database auditing may trigger
Extract managed firewall credentials and pivot
- GMS database stores firewall credentials or secrets
- Managed devices trust GMS or share credentials
- Secrets may be encrypted or hashed
- Managed firewalls may have MFA or separate admin accounts not in GMS
- Patching: no fixed version exists because product is EOL; patch management won't help.
- Antivirus/EDR on the GMS server: SQL injection is application-layer; host AV cannot inspect SQL queries.
- Network firewall rules allowing HTTPS to the GMS server: these only control who can connect, not what an authenticated admin can do.
The supporting signals.
| In-the-wild status | No known exploitation; not in CISA KEV. |
|---|---|
| KEV listed | No |
| PoC availability | No public exploit code; VulDB lists no exploit as of 2026-11-02. |
| EPSS score/percentile | Not available / likely very low (post-auth, no PoC) |
| Affected versions | GMS 9.5.2 and earlier (Windows and Virtual Appliance) |
| Fixed versions | None — product is end-of-life |
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N (vendor: MEDIUM 6.8) |
| Scanning/exposure | GMS is typically internal network; internet-facing exposure not expected; no Shodan data available. |
| Disclosure date | 2026-11-03 |
| Reporter/organization | SonicWall PSIRT (SNWLID-2026-0019) |
Sources.
Why this verdict
- Friction audit: requires valid high-privilege GMS admin account — attacker is already inside the management plane before exploiting this, which limits the reachable population.
- Role multiplier: GMS is central management for SonicWall firewalls; a successful SQLi can dump stored credentials/configs and enable fleet-wide firewall compromise.
- EOL/no patch: no patch or workaround exists, so any compromised deployment remains exploitable until decommissioned or migrated.
Why not higher?
Not unauthenticated: the attacker cannot trigger the SQLi without a valid high-privilege session, and no public exploit or in-the-wild activity exists. The added step of obtaining admin credentials substantially reduces the chance of mass opportunistic exploitation.
Why not lower?
The affected component sits in a high-value management role; database access can lead to fleet-scale credential exposure and firewall compromise. EOL status removes the usual patch remedy and raises the need for immediate isolation/migration.
Crowdsourced verification payload.
Run this script on the GMS server itself (Windows or Linux) with local administrator/root privileges. Invoke with python check_gms_cve_2026_109594.py; it will check the installed GMS version and output VULNERABLE, PATCHED, or UNKNOWN. On Windows it reads the registry; on Linux it checks common installation paths.
#!/usr/bin/env python3
import sys, os, platform
def get_windows_version():
import winreg
keys = [
(winreg.HKEY_LOCAL_MACHINE, r"SOFTWARE\SonicWall\GMS"),
(winreg.HKEY_LOCAL_MACHINE, r"SOFTWARE\WOW6432Node\SonicWall\GMS"),
]
for root, path in keys:
try:
with winreg.OpenKey(root, path) as k:
ver, _ = winreg.QueryValueEx(k, "Version")
return ver
except Exception:
continue
return None
def get_linux_version():
paths = ["/opt/sonicwall/gms/version", "/usr/local/sonicwall/gms/version", "/etc/sonicwall/gms/version"]
for p in paths:
if os.path.exists(p):
with open(p) as f:
return f.read().strip()
return None
def main():
ver = None
if platform.system() == "Windows":
ver = get_windows_version()
else:
ver = get_linux_version()
if ver is None:
print("UNKNOWN: GMS version not found")
sys.exit(2)
try:
parts = ver.split(".")[:3]
major = int(parts[0])
minor = int(parts[1])
patch = int(parts[2]) if len(parts) > 2 else 0
except Exception:
print(f"UNKNOWN: cannot parse version {ver}")
sys.exit(2)
if (major < 9) or (major == 9 and minor < 5) or (major == 9 and minor == 5 and patch <= 2):
print(f"VULNERABLE: GMS version {ver} is 9.5.2 or earlier")
sys.exit(1)
else:
print(f"PATCHED: GMS version {ver} is later than 9.5.2")
sys.exit(0)
if __name__ == "__main__":
main()