SonicWall Global Management System (GMS)

• CVE-2026-109594 Medium 6.8 Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions w 0.4%
• CVE-2026-109593 Critical 9.1 An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information. 0.5%
• CVE-2021-20020 Unrated A command execution vulnerability in SonicWall GMS 9.3 allows a remote unauthenticated attacker to locally escalate privilege to root. 3.9%