SonicWall GMS: end-of-life, no fix coming for pre-auth file read and SQL injection (CVE-2026-109593, CVE-2026-109594)
SonicWall Global Management System (GMS) 9.5.2 and earlier
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
SonicWall disclosed two flaws in its end-of-life Global Management System (GMS) 9.5.2 and earlier and said no security update will be released. CVE-2026-109593 lets an unauthenticated attacker with network access read internal GMS files and expose sensitive information (CVSS 9.1 from CISA's ADP). CVE-2026-109594 is a post-authentication SQL injection that can let a high-privileged attacker access or modify data in the GMS database (CVSS 6.8). The flaws were reported by Pentest-Tools researchers. SonicWall urges customers to move to Network Security Manager (NSM); until then, keep GMS off untrusted networks.
Why this severity: CVE-2026-109593 is CVSS 9.1 (CISA ADP), pre-auth; no exploitation reported; product is EOL and will not be patched
- Started
- Nov 3, 2026
Affected
- GMS 9.5.2 and earlier
Fixed in
No fixed release yet
Timeline2
Advisories3
Notes & caveats
CISA SSVC (2026-11-03): exploitation none, automatable yes for CVE-2026-109593.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
