SonicWall has disclosed two vulnerabilities in its Global Management System (GMS) and says it will not fix either of them. The more severe flaw, CVE-2026-109593, lets an unauthenticated attacker with network access read internal GMS files. The second, CVE-2026-109594, is a SQL injection that an authenticated attacker can use to access or modify data in the GMS database.
Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
Both affect GMS 9.5.2 and earlier. GMS reached its end of support on September 30, 2026, so the only remedy SonicWall offers is migration to its Network Security Manager (NSM) platform.
What SonicWall Disclosed on November 3
SonicWall published security advisory SNWLID-2026-0019 on November 3, 2026. The advisory indicates that the product has reached its end of life (EOL), no security updates or remediations will be issued, and organizations are strongly advised to migrate to NSM.
The advisory details two key vulnerabilities: CVE-2026-109593, a critical file read flaw requiring no credentials, and CVE-2026-109594, a medium-severity SQL injection that requires high-privilege access. Both flaws were found by Pentest-Tools.com researchers. The CVE records credit Matei “Mal” Badanoiu for both issues and Andrei Lungu for CVE-2026-109594.
Why the File Read Flaw Rates Critical
CVE-2026-109593 (CVSS 9.1) needs no credentials and no user interaction. Its CVE record carries the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, meaning a low-complexity network attack with high confidentiality and availability impact. The record classifies the root cause as a component that does not fail securely, but neither SonicWall nor the researchers have published which GMS files are reachable or which request triggers the issue.
The direct effect is file disclosure. Any further impact depends on what those files hold. GMS is a central console for managing SonicWall firewalls, so internal files could contain configuration data, credentials or details about the managed devices. That is a potential outcome, not one the advisory describes.
Details of CVE-2026-109593 (SOCRadar Vulnerability Intelligence)
How Much Does the SQL Injection Add?
CVE-2026-109594 (CVSS 6.8) is harder to reach. The attacker must already be authenticated with high privileges, and SonicWall says exploitation works only “in specific conditions” without defining them.
Details of CVE-2026-109594 (SOCRadar Vulnerability Intelligence)
The CVE description says an attacker could modify information in the database, while its published vector rates integrity impact as none. Until SonicWall clarifies, defenders should assume that both reading and altering GMS database records are possible for a privileged attacker.
The two flaws have not been described as a chain. Still, a file read that exposes administrator credentials would satisfy the authentication requirement for the SQL injection, so organizations should not treat the lower score as a reason to wait.
Is Anyone Exploiting the GMS Flaws?
As of November 5, 2026, there are no public reports of exploitation for either CVE, and no public proof-of-concept exploit has been identified. Neither flaw appears in CISA’s Known Exploited Vulnerabilities catalog.
That status can change quickly for SonicWall products. In October, SonicWall fixed CVE-2026-102255, a CVSS 10.0 pre-authentication server-side request forgery (SSRF) in its SMA 1000 appliances, and attack telemetry has since recorded over 2,900 exploitation attempts against it from ten IP addresses since October 9. Unlike that flaw, the GMS issues will never receive a patch, so any exploit that appears will work against every remaining GMS 9.5.2 deployment.
GMS End-of-Life Timeline
SonicWall’s end-of-life notice set the GMS retirement schedule more than a year ago:
| Date | Milestone |
|---|---|
| May 5, 2025 | End-of-life announcement; Active Retirement Mode begins |
| October 1, 2025 | Last day to order; Limited Retirement Mode begins |
| September 30, 2026 | End of support |
| November 3, 2026 | SNWLID-2026-0019 published with no fix |
SonicWall names NSM 3.0 SaaS and NSM 3.0 On-Prem as the replacement products and says the SaaS edition has feature parity with GMS.
Reducing Risk Until GMS Is Retired
Migration to NSM is the only vendor-endorsed fix. Teams that cannot complete it right away can reduce exposure with general measures; these are not SonicWall mitigations:
- Remove internet exposure: Make sure no GMS web or management interface is reachable from the internet, and limit access to a small set of administrator hosts or a VPN
- Audit privileged accounts: Review GMS administrator accounts, remove unused ones and require strong, unique passwords, since CVE-2026-109594 depends on high-privilege access
- Rotate stored secrets: Change credentials and shared secrets that GMS stores for managed firewalls if the console has been reachable by untrusted networks
- Watch the logs: Monitor GMS web server and reverse-proxy logs for unusual file requests and unexpected administrative sessions, and review managed firewall configurations for unexplained changes
- Set a cutover date: Treat GMS as an unsupported system with a fixed decommission date rather than an ongoing exception
A clean log review does not prove a GMS instance is safe, especially where logging was limited before the disclosure.
Quick Answers for GMS Administrators
Will SonicWall Release a Hotfix for GMS 9.5.2?
No. The advisory states that no remediation or security update will be released because the product is end of life.
Is NSM Affected by These CVEs?
The advisory and both CVE records list only GMS 9.5.2 and earlier. NSM is the replacement SonicWall recommends.
Does the SQL Injection Matter if No Outsider Has GMS Credentials?
Yes, if the file read exposes administrator credentials, or if a privileged account is already compromised. The two flaws have not been reported as a chain, but the combination is a reasonable risk to plan for.
Are Managed Firewalls Directly Vulnerable?
No firewall product is listed as affected. The risk to firewalls is indirect: data taken from GMS could help an attacker target the devices it manages.
Spotting Unsupported Management Consoles With SOCRadar
End-of-life software tends to stay in service long after support ends, and management consoles often store credentials for the devices they control. SOCRadar can help teams find and track these systems:
- Attack Surface Management: Identifies internet-facing assets, including exposed GMS consoles, so teams can confirm none remain reachable while migration is underway
- Cyber Threat Intelligence: Tracks CVE-2026-109593 and CVE-2026-109594 for new exploit releases, KEV additions and attack reports
- Dark Web Monitoring: Flags exploit sales, access offers or leaked credentials tied to the organization’s SonicWall infrastructure
Digital Footprint, SOCRadar Attack Surface Management module
Confirming whether a specific GMS server was accessed still requires review of its own logs and host telemetry.
Article Link: https://socradar.io/blog/sonicwall-gms-flaws-unpatched-after-end-of-life/