Search — “CVE-2026-102255”

SonicWall says two flaws in end-of-life Global Management System 9.5.2 and earlier will receive no fix; CVE-2026-109593 (CVSS 9.1) is an unauthenticated file read and CVE-2026-109594 (CVSS 6.8) is a post-authentication SQL injection. SonicWall recommends migrating to Network Security Manager (NSM). The source reports a related CVE-2026-102255 SSRF (CVSS 10.0) under active exploitation, with Previdian telemetry showing 2,541 attempts from eight IPs since October 9, 2026, but does not tie those attempts directly to the GMS flaws. Hunters should inventory any GMS instances and review web access for file-read requests.