Executive brief
SonicWall GMS is a centralized management platform for security appliances. Multiple cross-site scripting vulnerabilities allow remote attackers to inject malicious scripts that execute in users' browsers, potentially leading to session hijacking, credential theft, or unauthorized administrative actions.
Technical details
Multiple cross-site scripting (XSS) vulnerabilities exist in SonicWall GMS due to insufficient input validation or output encoding in the web interface. The vulnerabilities are reflected or stored XSS flaws that allow unauthenticated remote attackers to inject arbitrary JavaScript code. When a victim visits a malicious link or page, or accesses a compromised GMS instance, the injected script executes in their browser context with the privileges of their authenticated session. An attacker can steal session cookies, perform unauthorized administrative actions, or modify security policies.
Affected products
- SonicWall GMS 9.5.1 (Build 9510.1044) and earlier
Timeline
- 2026-08-11: disclosed