VULNpocalypse
HighVulnerabilityOngoing

SonicWall will not patch two flaws in end-of-life GMS 9.5.2 and earlier, including unauthenticated file read

SonicWall says two flaws in end-of-life GMS 9.5.2 and earlier will get no fix, so customers are urged to move to Network Security Manager.

Published
Fixed in
None. SonicWall says no remediation or security update will be released; migrate to Network Security Manager (NSM).
Exploitation
No confirmed exploitation of these two GMS flaws in the sources (not confirmed); a separate SonicWall flaw, CVE-2026-102255, is reported as exploited.

Live scores

CVE-2026-109593
EPSS
0.005
low predicted chance of attack
VEDAS
0.046
little exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

Live scores

CVE-2026-109594
EPSS
0.004
low predicted chance of attack
VEDAS
0.048
little exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

What happened

SonicWall warned customers of two vulnerabilities in its end-of-life Global Management System (GMS), and said it will not fix them. In a Tuesday alert, SonicWall said: “The affected product has reached End-of-Life (EOL). As a result, no remediation or security update will be released for these vulnerabilities.” It strongly encourages organizations to upgrade to NSM (BleepingComputer, The Hacker News).

GMS lets IT admins deploy and manage thousands of SonicWall appliances from one interface. SonicWall has replaced it with NSM. The flaws were found and reported by Pentest-Tools researchers and affect GMS 9.5.2 and earlier (BleepingComputer).

  • CVE-2026-109593 (CVSS 9.1): an unauthenticated file read. An attacker with network access can read internal GMS files and potentially expose sensitive information (The Hacker News).
  • CVE-2026-109594 (CVSS 6.8): a post-authentication SQL injection. A high-privileged, authenticated attacker can access or modify information in the GMS database under specific conditions. BleepingComputer describes it as a low-complexity attack (BleepingComputer, The Hacker News).

The NVD pages provided contained no record text, so the details above come from the news reports. Exploitation of these two GMS flaws is not confirmed in the sources.

Separately, The Hacker News reports that SonicWall recently fixed CVE-2026-102255 (CVSS 10.0), a pre-authenticated server-side request forgery flaw. Previdian telemetry recorded 2,541 attack attempts from eight unique IP addresses in Singapore and the U.S. since October 9, 2026, with as many as 30 attempts on November 3, 2026 (The Hacker News). BleepingComputer lists that CVE among SMA1000 flaws, and notes that SonicWall bugs are frequently targeted. It also reports that CISA has added 19 SonicWall vulnerabilities to its exploited list over four years, 13 of them also abused by ransomware gangs (BleepingComputer). That flaw is a different issue and is not part of the GMS advisory.

Am I affected?

You are affected if you run SonicWall GMS version 9.5.2 or any earlier version. Since GMS is end-of-life, no fixed GMS version exists. Customers already on NSM are not named as affected in the sources.

The file read flaw needs only network access to the GMS instance, with no authentication. The SQL injection needs an authenticated, high-privileged attacker.

What to do now

  1. Inventory your environment for any GMS instances at 9.5.2 or earlier.
  2. Plan and schedule migration to SonicWall Network Security Manager (NSM), the vendor’s stated path.
  3. Until you migrate, restrict network access to GMS so it is not reachable from untrusted networks. This is a general precaution and is not stated in the sources.
  4. Limit and review high-privileged GMS accounts, since the SQL injection requires elevated privileges. This is also a general precaution not stated in the sources.
  5. Treat files stored on GMS as potentially exposed, and consider rotating any credentials or secrets they contain. Whether such data exists on your instance is not confirmed by the sources.
  6. Track CVE-2026-109593 and CVE-2026-109594 on NVD for any further details.

Sources