CVE-2026-109594

{
  "etk_id": "ETK-2026-3508",
  "cve_id": "CVE-2026-109594",
  "display_id": "CVE-2026-109594",
  "ghsa_id": "GHSA-w3p9-mvmw-xhwm",
  "euvd_id": "EUVD-2026-116040",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Post-authentication SQL injection in SonicWall GMS",
  "summary": "SonicWall Global Management System 9.5.2 and earlier are affected by an SQL injection vulnerability. An attacker with valid authenticated access may be able to view or change information in the GMS database under certain conditions.",
  "mitigation": "Restrict GMS access to trusted administrators and tightly controlled management networks. Retire or migrate from the end-of-life GMS deployment; the evidence does not identify a fixed version.",
  "vendor": "SonicWall",
  "product": "Global Management System (GMS)",
  "affected": [
    {
      "affected_notes": [
        "9.5.2 and earlier versions"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Global Management System (GMS)",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 6.8,
  "cvss_src": "other",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 12.819781616666667,
  "t0_at": "2026-11-03T16:28:35.183000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-03T16:28:35.183000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T16:28:35.183000+00:00",
      "url": "https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-unpatched-flaws-in-end-of-life-gms-software/"
    }
  }
}