What SonicWall disclosed
SonicWall published advisory SNWLID-2026-0019 on Tuesday, November 3, 2026. It covers two vulnerabilities in GMS 9.5.2 and earlier. GMS lets administrators deploy and manage thousands of SonicWall security appliances from one interface. SonicWall has formally replaced it with NSM.
Researchers at Pentest-Tools found and reported both flaws. According to the CVE records, Matei 'Mal' Badanoiu found the first flaw, and the SQL injection credit goes to Matei 'Mal' Badanoiu and Andrei Lungu of Pentest-Tools.com.
SonicWall's position is clear. In the statement BleepingComputer quoted, the vendor said that because the product has reached end of life, "no remediation or security update will be released for these vulnerabilities." It strongly encourages customers to upgrade to NSM.
The two vulnerabilities
| CVE-2026-109593 | CVE-2026-109594 | |
|---|---|---|
| Type | Unauthenticated internal file read (CWE-636, "Not Failing Securely") | SQL injection (CWE-89) |
| Authentication needed | None, only network access | Yes, high privileges |
| Impact | Exposure of sensitive information from internal GMS files | Access to or changes in data in the GMS database |
| CVSS 3.1 (as published in CVE records) | 9.1 Critical | 6.8 Medium |
| Affected | GMS 9.5.2 and earlier | GMS 9.5.2 and earlier |
| Fix | None | None |
CVE-2026-109593: the serious one
The CVE record says an unauthenticated attacker with network access to GMS 9.5.2 or earlier may be able to read internal GMS files and expose sensitive information. CVE.report lists a CVSS 3.1 score of 9.1 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. That means it can be attacked over the network, it's easy to pull off, and it needs no credentials or user interaction. Confidentiality and availability impacts are rated high. The vendor-declared affected platforms are Windows and Linux.
Think about what a management server holds. It typically stores configuration data and credentials for many appliances. Any file-read bug on that box is a problem in its own right, and it can also be the first step toward bigger attacks. That last point is a general industry observation. Neither SonicWall nor the researchers have described such an attack chain.
CVE-2026-109594: the authenticated one
The second flaw is a post-authentication SQL injection which in specific conditions could potentially allow an authenticated attacker to access or modify information stored in the GMS database. The published vector, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, gives it a CVSS score of 6.8/10 (MEDIUM severity). The "PR:H" part means the attacker needs high privileges.
Scores differ between aggregators. VulDB's entry shows a base score of 6.3 and labels the bug a vulnerability classified as critical. Others list NVD analysis as still pending. Treat 6.8 as the CNA-supplied figure, not the final word.
Section summary: One bug lets an attacker with no credentials read files over the network. The other lets a privileged insider, or someone using stolen admin credentials, tamper with the database. Neither will be patched.
Is anyone exploiting these yet?
There's no public evidence of exploitation. SecurityOnline lists both flaws as No confirmed exploitation yet, and the OffSeq Threat Radar entry says Not known to be exploited · CVSS 6.8 Medium · end of life, no fix coming.
SonicWall's track record still argues against complacency. BleepingComputer reports that over the past four years, CISA has added 19 SonicWall vulnerabilities to its Known Exploited Vulnerabilities catalog, and 13 of them were also used by ransomware gangs. The outlet also notes that attackers have exploited several SonicWall flaws as zero-days this year, mostly in SMA1000 appliances. Some of BleepingComputer's SMA1000 CVE-to-month listings look inconsistent, so we've left them out here. They aren't needed for the GMS story either way.
In practice, an unpatched, unauthenticated, critical bug in a product from a vendor that attackers already target is often a candidate for future exploitation. That's an analytical judgment, not a reported fact.
Don't confuse this with August's GMS notice
SonicWall's support portal also lists a separate notice, dated August 11, 2026, titled "SonicWall GMS Security Affected By Multiple Vulnerabilities." That is a different item. The November 3 advisory, SNWLID-2026-0019, is the one covering CVE-2026-109593 and CVE-2026-109594. If you dealt with the August notice, you still need to deal with this one.
What GMS administrators should do now
SonicWall's only recommendation is to migrate to NSM. The vendor advisory couldn't be retrieved in readable form during our research, so we can't confirm SonicWall's specific migration prerequisites or supported NSM versions. Use SonicWall's own NSM documentation for those details. Here's what you can do in the meantime:
- Find every GMS instance you have. Check for GMS 9.5.2 or earlier on both Windows and Linux hosts. Include lab boxes, disaster recovery replicas and any console a managed service provider runs for you.
- Plan the move to NSM. This is the vendor's stated fix. Treat it as a project with a deadline, not something for the backlog.
- Cut down network access to GMS until it's retired. CVE-2026-109593 only needs network access to the server. Restricting who can reach it to a dedicated management network or a short list of admin IP addresses shrinks the exposure. This is general defensive practice, not a SonicWall-documented mitigation, and it doesn't fix the bug.
- Review privileged GMS accounts. CVE-2026-109594 needs high privileges. Removing stale admin accounts, rotating credentials and enforcing MFA wherever your setup supports it make that path harder to use.
- Assume configuration data may be exposed. If a GMS server has ever been reachable from untrusted networks, consider rotating any secrets it stores as a precaution. That's an analytical recommendation; there are no reported compromises.
The OffSeq tracker sums up the choice: replace or isolate SonicWall Global Management System (GMS); no fix will be released.
Section summary: Inventory, isolate and migrate. A patch is not coming.
The bigger picture: end of life means end of fixes
This keeps happening. A management tool reaches end of support, keeps working fine, and stays in production because migrating it is tedious. Then someone finds a bug. Windows admins know this pattern from unsupported Server releases and Exchange versions that stayed in use long after the patches stopped.
Management planes are an especially bad place to cut corners. One compromised console can expose the whole fleet of security appliances it manages. The irony is that a box meant to keep firewalls in line could become the weakest point on the network.
It's fair to point out that SonicWall disclosed these flaws publicly and credited the researchers, even though GMS is no longer supported. Some vendors simply ignore reports against retired products. The disclosure gives defenders the information they need. What's left is the work of migrating.
Bottom line
Two newly disclosed flaws affect SonicWall GMS 9.5.2 and earlier, and SonicWall will not patch them:
- CVE-2026-109593: an unauthenticated file read rated 9.1 Critical.
- CVE-2026-109594: an authenticated SQL injection rated 6.8 in the CVE record.
Neither is known to be exploited yet. Given how often attackers go after SonicWall products, migrating to NSM should be on this quarter's schedule, and until then any remaining GMS servers should be locked down on the network.