SonicWall discloses two unpatched flaws in end of life GMS

SonicWall has disclosed two vulnerabilities in its Global Management System (GMS) and says there will be no fixes because the product has reached end of life. The more severe flaw, CVE-2026-109593, allows an unauthenticated attacker with network access to read internal GMS files. The second, CVE-2026-109594, is an SQL injection that an authenticated attacker with high privileges can use to access or modify data in the GMS database.

Both flaws affect GMS version 9.5.2 and earlier, and SonicWall’s end-of-support date for GMS was 30 September 2026; the advised remedy is migration to its Network Security Manager (NSM) platform.

SonicWall published advisory SNWLID-2026-0019 on 3 November 2026, noting no security updates or remediations will be issued due to the EOL status. The vulnerabilities were identified by Pentest-Tools[.]com researchers, with CVE credit attributed to Matei “Mal” Badanoiu for both issues and Andrei Lungu for CVE-2026-109594. CVE-2026-109593 is rated CVSS 9.1, describing a no-credentials, no-user-interaction file-disclosure flaw with a network attack vector.

The SQL injection, CVE-2026-109594, is CVSS 6.8 and requires high-privilege authentication, with SonicWall noting exploitation would occur only under specific conditions. As of 5 November 2026, there were no public exploitation reports or PoCs, and the flaws are not listed in CISA’s Known Exploited Vulnerabilities. Defenders are urged to migrate to NSM, or, if immediate migration is not possible, to reduce exposure by hardening access and monitoring activity as detailed in the advisory.