SonicWall Leaves Two GMS Vulnerabilities Unpatched After End of Support

Summary

SonicWall disclosed two flaws in end-of-life GMS 9.5.2 and earlier: an unauthenticated network file-read bug (CVE-2026-109593) and a privileged SQL injection (CVE-2026-109594). No patches are planned; migration to NSM is the vendor's remedy.

Key points

SonicWall advisory SNWLID-2026-0019, published November 3, says no security updates or remediation will be issued for GMS, whose support ended September 30, 2026.
CVE-2026-109593 is a CVSS 9.1 unauthenticated, network-accessible file-read flaw affecting GMS 9.5.2 and earlier. The reachable files and triggering request have not been disclosed.
CVE-2026-109594 is a CVSS 6.8 SQL injection requiring an authenticated, high-privilege account; SonicWall says exploitation works only under unspecified conditions.
The flaws have not been described as a chain. The article notes that credentials exposed by the file-read flaw could potentially satisfy the SQL injection's authentication requirement.
As of November 5, the article reports no public exploitation or proof-of-concept exploit for either flaw; neither is listed in CISA's Known Exploited Vulnerabilities catalog.
SonicWall recommends migrating to Network Security Manager (NSM). Interim measures suggested by the article include restricting GMS access, reviewing privileged accounts, rotating stored secrets, and monitoring logs; these are not vendor-issued mitigations.

Article Details

Vulnerability Types: Unauthenticated file read
SQL injection
Severity: CVE-2026-109593: Critical (CVSS 9.1); CVE-2026-109594: Medium (CVSS 6.8).
Affected Versions: GMS 9.5.2 and earlier
Exploitation Status: not_reported
Exploit Availability: none_reported
Patch Status: unavailable
Workarounds: Migrate to NSM, the vendor-endorsed remedy.
Remove internet exposure and restrict management-interface access to a small set of administrator hosts or a VPN.
Review privileged GMS accounts, remove unused accounts, and require strong, unique passwords.
Rotate credentials and shared secrets stored in GMS for managed firewalls if the console was reachable by untrusted networks.
Monitor GMS web server and reverse-proxy logs for unusual file requests and unexpected administrative sessions; review managed firewall configurations for unexplained changes.