607/69 Thursday, November 5, 2026
SonicWall has issued an advisory covering two vulnerabilities in its Global Management System (GMS), a centralized platform used by IT administrators to deploy, configure, and manage large numbers of SonicWall security appliances. The flaws affect SonicWall GMS version 9.5.2 and earlier and were discovered and reported by cybersecurity researchers from Pentest-Tools. SonicWall stated that GMS has reached End-of-Life (EOL) and has been replaced by the Network Security Manager (NSM) platform. As a result, the company will not release security patches or updates to remediate the vulnerabilities.
The first vulnerability, CVE-2026-109593, could allow an unauthenticated attacker with network access to the GMS system to read local files and access sensitive information without authorization. The second, CVE-2026-109594, is a SQL Injection vulnerability that could allow a highly privileged user to access or modify information stored in the GMS database. SonicWall described exploitation as requiring low attack complexity. Both vulnerabilities affect systems still running SonicWall GMS version 9.5.2 and earlier, increasing the risk of sensitive information exposure and unauthorized modification of data within an organization’s centralized security management environment.
SonicWall confirmed that no patches will be released for either vulnerability because GMS is no longer supported and recommends that organizations still using the product migrate to SonicWall Network Security Manager (NSM). SonicWall products have also been targeted through other vulnerabilities in recent years, including a zero-day vulnerability affecting SMA 1000 appliances that was exploited in the wild in 2026. In addition, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added 19 SonicWall vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog over the past four years, including 13 reportedly exploited in ransomware activity. Organizations should therefore review their deployed SonicWall products and plan to retire unsupported systems to reduce exposure to vulnerabilities that will no longer receive security fixes.