SonicWall Warns of Two Unpatched Flaws in End-of-Life GMS Software
Summary
SonicWall says two flaws affect GMS 9.5.2 and earlier, including unauthenticated access to internal files and privileged SQL injection. No patches will be released because the product is end-of-life; customers are urged to upgrade to NSM.
Key points
- The flaws, CVE-2026-109593 and CVE-2026-109594, affect SonicWall GMS 9.5.2 and earlier.
- CVE-2026-109593 allows unauthenticated attackers with network access to read internal files and steal sensitive information.
- CVE-2026-109594 may let high-privilege threat actors access or modify GMS database information through low-complexity SQL injection.
- Pentest-Tools researchers found and reported the vulnerabilities.
- SonicWall says it will release no remediation or security updates because GMS is end-of-life, and urges customers to upgrade to Network Security Manager (NSM).
Article Details
- Vulnerability Types
- Unauthenticated reading of internal files, enabling sensitive information theft
- SQL injection that can allow access to or modification of GMS database information
- Affected Versions
- SonicWall GMS 9.5.2 and earlier
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- unavailable
- Workarounds
- Upgrade to SonicWall Network Security Manager (NSM).
CVE
CVE-2026-109593SonicWall · Global Management System (GMS)The first GMS flaw disclosed this week is tracked as CVE-2026-109593, and it enables unauthenticated attackers with network access to vulnerable instances (running GMS 9.5.2 and earlier versions) to steal sensitiveCVE-2026-109594SonicWall · Global Management System (GMS)SonicWall also flagged a second security issue (CVE-2026-109594) that can let threat actors with high privileges access or modify information stored in the GMS database through low-complexity SQL Injection attacks.
Vendors
Products
Global Management System (GMS)SonicWall warned customers of two security flaws affecting end-of-life Global Management System (GMS) systems that will not be patched.Network Security Manager (NSM)appliances from a single interface, but SonicWall has officially replaced it with the Network Security Manager (NSM) management platform.