SonicWall GMS
24 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-18634 | 9.5.1 and earlier versions | An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and | HIGH 8.4 | 0.3 % | ||
| CVE-2026-66154 | 9.5.1 and earlier versions | An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) a | HIGH 8.3 | 0.2 % | ||
| CVE-2026-66148 | 9.5.1 and earlier versions | An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier vers | MEDIUM 6.3 | 1.1 % | ||
| CVE-2026-66147 | 9.5.1 and earlier versions | An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allo | CRITICAL 9.4 | 1.8 % | ||
| CVE-2026-66146 | 9.5.1 and earlier versions | Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-66145 | 9.5.1 and earlier versions | An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remot | CRITICAL 9.1 | 0.7 % | ||
| CVE-2024-29011 | 9.3.4 and earlier versions | Use of hard-coded password in the GMS ECM endpoint leading to authentication bypass vulnerability. This issue affects GMS: 9.3.4 and earlie | HIGH 7.5 | 0.9 % | ||
| CVE-2024-29010 | 9.3.4 and earlier versions | The XML document processed in the GMS ECM URL endpoint is vulnerable to XML external entity (XXE) injection, potentially resulting in the di | HIGH 7.1 | 0.6 % | ||
| CVE-2023-34137 | 9.3.2-SP1 and earlier versions | SonicWall GMS and Analytics CAS Web Services application use static values for authentication without proper checks leading to authenticatio | CRITICAL 9.8 | 1.0 % | ||
| CVE-2023-34136 | 9.3.2-SP1 and earlier versions | Vulnerability in SonicWall GMS and Analytics allows unauthenticated attacker to upload files to a restricted location not controlled by the | CRITICAL 9.8 | 0.8 % | ||
| CVE-2023-34135 | 9.3.2-SP1 and earlier versions | Path Traversal vulnerability in SonicWall GMS and Analytics allows a remote authenticated attacker to read arbitrary files from the underlyi | MEDIUM 6.5 | 1.6 % | ||
| CVE-2023-34134 | 9.3.2-SP1 and earlier versions | Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics allows authenticated attacker to rea | MEDIUM 6.5 | 1.1 % | ||
| CVE-2023-34133 | 9.3.2-SP1 and earlier versions | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and Analytics allows an | HIGH 7.5 | 73 % | ||
| CVE-2023-34132 | 9.3.2-SP1 and earlier versions | Use of password hash instead of password for authentication vulnerability in SonicWall GMS and Analytics allows Pass-the-Hash attacks. This | CRITICAL 9.8 | 7.7 % | ||
| CVE-2023-34131 | 9.3.2-SP1 and earlier versions | Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics enables an unauthenticated attacker | MEDIUM 5.3 | 0.8 % | ||
| CVE-2023-34130 | 9.3.2-SP1 and earlier versions | SonicWall GMS and Analytics use outdated Tiny Encryption Algorithm (TEA) with a hardcoded key to encrypt sensitive data. This issue affects | CRITICAL 9.8 | 0.3 % | ||
| CVE-2023-34129 | 9.3.2-SP1 and earlier versions | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in SonicWall GMS and Analytics allows an authen | HIGH 8.8 | 41 % | ||
| CVE-2023-34128 | 9.3.2-SP1 and earlier versions | Tomcat application credentials are hardcoded in SonicWall GMS and Analytics configuration file. This issue affects GMS: 9.3.2-SP1 and earlie | CRITICAL 9.8 | 0.7 % | ||
| CVE-2023-34127 | 9.3.2-SP1 and earlier versions | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SonicWall GMS, SonicWall Analyti | HIGH 8.8 | 86 % | ||
| CVE-2023-34126 | 9.3.2-SP1 and earlier versions | Vulnerability in SonicWall GMS and Analytics allows an authenticated attacker to upload files on the underlying filesystem with root privile | HIGH 8.8 | 0.8 % | ||
| CVE-2023-34125 | 9.3.2-SP1 and earlier versions | Path Traversal vulnerability in GMS and Analytics allows an authenticated attacker to read arbitrary files from the underlying filesystem wi | MEDIUM 6.5 | 24 % | ||
| CVE-2023-34124 | 9.3.2-SP1 and earlier versions | The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. This issue | CRITICAL 9.8 | 50 % | ||
| CVE-2023-34123 | 9.3.2-SP1 and earlier versions | Use of Hard-coded Cryptographic Key vulnerability in SonicWall GMS, SonicWall Analytics. This issue affects GMS: 9.3.2-SP1 and earlier versi | HIGH 7.5 | 0.8 % | ||
| CVE-2019-7478 | GMS 8.4 ; GMS 8.5 ; GMS 8.6 ; … | A vulnerability in GMS allow unauthenticated user to SQL injection in Webservice module. This vulnerability affected GMS versions GMS 8.4, 8 | CRITICAL 9.8 | 1.1 % |