CVE-2026-109593
CVE-2026-109594Allows unauthenticated file reading and authenticated database changes in SonicWall GMS
Two unpatched vulnerabilities affect SonicWall's end-of-life Global Management System (GMS) versions 9.5.2 and earlier. The first lets an unauthenticated attacker read internal GMS files, potentially exposing sensitive information. The second is an SQL injection flaw that allows an authenticated attacker to access or modify data in the GMS database. SonicWall will not issue patches and advises upgrading to the Network Security Manager (NSM) platform.
SonicWall Global Management System (GMS) · Updated 4 Nov · From 1 of our story and the public records
Being exploitedNot reportedNo attacks reported in the records
CISA known exploitedNot listedThe US list of flaws under attack
SeveritycriticalCVSS 9.1 of 10
FixNot yetSee what to do below
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- Upgrade to SonicWall Network Security Manager (NSM) as recommended by SonicWall, since no patches are coming for the end-of-life GMS software.
- If you cannot upgrade immediately, restrict network access to the GMS system to trusted users only, following SonicWall's guidance.
What happened
- 4 NovSonicWall warns customers about two unpatched vulnerabilities in end-of-life GMS software and urges upgrading to NSM.
The 2 records
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-109593 | An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sen… | critical 9.1 | No | 0.5% |
| CVE-2026-109594 | Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has been identified in the End-of-Life So… | medium 6.8 | No | 0.4% |
Our reporting
4 NovSonicWall warns of two unpatched vulnerabilities in end-of-life GMS management softwareReported elsewhere
The Hacker News · 4 NovSonicWall Won't Patch EoL GMS Flaws That Could Expose Files, Alter Database Records ↗BleepingComputer · 4 NovSonicWall warns of unpatched flaws in end-of-life GMS software ↗The records
psirt.global.sonicwall.com: advisory ↗psirt.global.sonicwall.com: advisory ↗CVE-2026-109593 on NVD ↗CVE-2026-109594 on NVD ↗Is anything you run affected?Connect Zotpaper to Claude, ChatGPT or Cursor and ask. It checks your project's packages against this vulnerability and every other one in the advisory databases, and says what to update. Your first 20 lookups are free.
Try it free