CERT-FR Advisory: SonicWall GMS Flaws Enable SQL Injection and Data Exposure (No Patch, EOL)
CERT-FR issued advisory CERTFR-2026-AVI-1456 on 04 November 2026 covering multiple vulnerabilities in SonicWall Global Management System (GMS) version 9.5.2 and earlier. The flaws, tracked as CVE-2026-109593 and CVE-2026-109594, can lead to a breach of data confidentiality and SQL injection (SQLi). SonicWall has confirmed that GMS has reached end-of-life and will not receive security patches for these issues. The advisory references SonicWall's own bulletin SNWLID-2026-0019 published 03 November 2026.
Entenda a falha
A vulnerabilidade
CVE-2026-109593 and CVE-2026-109594 affect SonicWall Global Management System (GMS) version 9.5.2 and earlier. According to CERT-FR, they allow an attacker to breach data confidentiality and to perform SQL injection (SQLi). The articles do not say which CVE maps to which impact, nor the CVSS score, the required authentication, network reach or the affected component. GMS is end-of-life, so SonicWall will not issue security patches and no fixed version exists.
Como funciona
The articles do not describe how the vulnerable process works. They only state the impact: SQL injection, meaning attacker-influenced input can reach a database query, and unauthorized disclosure of sensitive data. The exact entry point and the step where the software fails are not given in the sources.
Por que é vulnerável
The root cause is not detailed in the articles. The class of flaw (SQL injection) generally points to input not being handled safely before it is used in a database query, but this is an inference from the label, not something the sources explain. What is stated is that the product is end-of-life, so the fix will not come: SonicWall will not patch these issues.
Como foi descoberta
The articles do not say who found the flaws or how. CERT-FR published advisory CERTFR-2026-AVI-1456 on 4 November 2026, referencing SonicWall's bulletin SNWLID-2026-0019 of 3 November 2026. No exploitation in the wild is mentioned.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 16:21.
Detalhes técnicos
- Affected product: SonicWall GMS version 9.5.2 and prior (end-of-life, no longer supported).
- Vulnerabilities enable SQL injection and unauthorized disclosure of sensitive data.
- Tracked as CVE-2026-109593 and CVE-2026-109594.
Remediação
- No patches will be issued since GMS is end-of-life; administrators are directed to the vendor bulletin for guidance, which likely recommends migration to a supported product.
Linha do tempo
-
CERT-FR Advisory: SonicWall GMS Flaws Enable SQL Injection and Data Exposure (No Patch, EOL)
ler a análise desta fonte ocultar
CERT-FR issued advisory CERTFR-2026-AVI-1456 on 04 November 2026 covering multiple vulnerabilities in SonicWall Global Management System (GMS) version 9.5.2 and earlier. The flaws, tracked as CVE-2026-109593 and CVE-2026-109594, can lead to a breach of data confidentiality and SQL injection (SQLi). SonicWall has confirmed that GMS has reached end-of-life and will not receive security patches for these issues. The advisory references SonicWall's own bulletin SNWLID-2026-0019 published 03 November 2026.
Technical Details
- Affected product: SonicWall GMS version 9.5.2 and prior (end-of-life, no longer supported).
- Vulnerabilities enable SQL injection and unauthorized disclosure of sensitive data.
- Tracked as CVE-2026-109593 and CVE-2026-109594.
Remediation
- No patches will be issued since GMS is end-of-life; administrators are directed to the vendor bulletin for guidance, which likely recommends migration to a supported product.