SonicWall Won't Patch Critical Flaws in End-of-Life GMS
SonicWall confirmed that two flaws in end-of-life Global Management System (GMS) 9.5.2 and earlier will not be patched. CVE-2026-109593 (CVSS 9.1) allows unauthenticated reads of internal files, and CVE-2026-109594 (CVSS 6.8) is authenticated SQL injection. No public PoC or confirmed exploitation exists; the company urges migration to Network Security Manager (NSM).
What happened
SonicWall disclosed two security flaws in Global Management System (GMS) 9.5.2 and earlier and confirmed they will not be patched because the product is end-of-life. The most severe (CVSS 9.1) lets an attacker read internal files without credentials or user interaction. The other (CVSS 6.8) allows authenticated users to exploit SQL injection and access or modify the database.
Why it matters
GMS is the central security management platform; companies still running it keep a critical flaw with no fix coming. An attacker with network access can read sensitive internal files without credentials, and authenticated users can alter database records. Windows and Linux deployments are both affected.
What to do
Plan an immediate migration to Network Security Manager (NSM), as SonicWall urges. Until the switch is done, inventory where GMS 9.5.2 or earlier still runs and treat it as permanently exposed, since no patch will be released.
For the technical team
- CVE
- CVE-2026-109593, CVE-2026-109594
- Affected
- SonicWall Global Management System (GMS) · SonicWall GMS 9.5.2 and earlier; Windows and Linux deployments (per DarkWebInformer).
- Exploitation
- No identified public PoC and no confirmed exploitation in the wild, per DarkWebInformer.
- Fix
- No patch will be released; GMS is end-of-life. SonicWall urges migration to Network Security Manager (NSM).
- Vector
- Two flaws in SonicWall GMS: unauthenticated file read (CVE-2026-109593, CVSS 9.1), exploitable by an attacker with network access, no privileges or user interaction required; and authenticated SQL injection (CVE-2026-109594, CVSS 6.8), with access to or modification of the GMS database.
- More details
- Disclosure came from SonicWall itself in a security advisory. The unauthenticated file read can expose internal GMS files; the SQL injection affects database records.
Timeline
Vendor advisory pins affected versions at GMS 9.5.2 and earlier, unpatched due to end-of-life; the unauthenticated file read flaw (CVE-2026-109593) scores CVSS 9.1.
Vendor confirms end-of-life GMS 9.5.2 and earlier will get no patches, adds CVE-2026-109594 (authenticated SQL injection) and urges migration to NSM.
Incident opened.
Sources 3 sources
- @DarkWebInformer @DarkWebInformer
- @TheHackersNews @TheHackersNews
- SonicWall Won't Patch EoL GMS Flaws That Could Expose Files, Alter Database Records The Hacker News
