SonicWall discloses two unpatched GMS vulnerabilities

SonicWall has disclosed two critical, unpatched vulnerabilities in its Global Management System (GMS), tracked as CVE-2026-109593 and CVE-2026-109594, with a highest CVSS score of 9.1. The vendor’s security notice dated 3 November 2026 warns that these flaws affect GMS installations on version 9.5.2 and earlier, including Virtual Appliance and Windows builds.

CVE-2026-109593 enables unauthenticated file disclosure by failing open during access checks, potentially allowing an attacker with network access to read internal GMS files. CVE-2026-109594 is an authenticated SQL injection flaw where a user with login rights can submit malicious SQL commands to view or modify records in the main database and steal private logs. At this time, SonicWall reports no confirmed exploitation in customer networks and notes that there is no public exploit code.

The vulnerabilities arise from weaknesses in system files and database queries, and SonicWall has confirmed there will be no patches due to the end-of-life status of GMS. The recommended response is to take affected hosts offline and migrate to Network Security Manager to maintain security, while also blocking web ports to stop anomalous traffic.

Both CVEs are described as not exploited in practice to date, per the advisory and the article’s summary, and administrators are advised to refer to the vendor advisories SNWLID-2026-0019 for detailed mitigations.