SonicWall GMS Flaws Unpatched After End of Life

What happened?

SonicWall has disclosed two vulnerabilities in its Global Management System (GMS) and says it will not fix either of them. The more severe flaw, CVE-2026-109593, lets an unauthenticated attacker with network access read internal GMS files. The second, CVE-2026-109594, is a SQL injection that an authenticated attacker can use to access or modify data in the GMS database. Both affect GMS 9.5.2 and earlier. GMS reached its end of support on September 30, 2026, so the only remedy SonicWall offers is migration to its Network Security Manager (NSM) platform.

Key details

• SonicWall disclosed two vulnerabilities in GMS and will not fix them because the product reached end of support.
• Both vulnerabilities affect GMS 9.5.2 and earlier versions.
• SonicWall recommends migration to Network Security Manager (NSM) as the only remedy.
• No public exploitation or proof-of-concept exploits have been reported for either CVE as of November 5, 2026.

Summarised by SecOraLens from SOCRadar. Always read the original source before acting. How SecOraLens verifies advisories.