● Covered by 2 sources · 2 reportsMedium impact1 negative1 neutral
SonicWall Warns of Unpatched Vulnerabilities in End-of-Life GMS Software
Key points
- Two unpatched vulnerabilities affect SonicWall GMS 9.5.2 and earlier.
- CVE-2026-109593 allows unauthenticated file reads, exposing sensitive data.
- CVE-2026-109594 is a post-authentication SQL injection flaw.
- SonicWall will not release patches as GMS has reached End-of-Life (EoL).
- Users are advised to upgrade to SonicWall Network Security Manager (NSM).
Unpatched Flaws in End-of-Life GMS
SonicWall has alerted customers about two security vulnerabilities present in its Global Management System (GMS) software. These flaws, identified as CVE-2026-109593 and CVE-2026-109594, impact GMS versions 9.5.2 and earlier. The company has stated that no security updates or remediation will be provided for these issues.
Details of the Vulnerabilities
CVE-2026-109593, with a CVSS score of 9.1, is an unauthenticated file read vulnerability. It allows attackers with network access to vulnerable GMS instances to read internal files, potentially exposing sensitive information. The second flaw, CVE-2026-109594, has a CVSS score of 6.8 and is a post-authentication SQL injection vulnerability. This could enable an authenticated attacker to access or modify data within the GMS database under specific conditions.
End-of-Life Status and No Patches
The reason for the lack of patches is that SonicWall GMS has reached its End-of-Life (EoL) status. GMS was designed to help IT administrators deploy and manage numerous SonicWall security appliances from a single interface. However, SonicWall has officially replaced GMS with its Network Security Manager (NSM) platform.
Migration Recommended
SonicWall strongly encourages organizations still using the affected GMS product to upgrade to the SonicWall Network Security Manager (NSM). This migration is advised to mitigate the security risks associated with the unpatched vulnerabilities in the EoL software.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
CVE CVE-2026-1095939.1 CRITICAL CVE CVE-2026-1095946.8 MEDIUM CVE CVE-2026-1540910.0 CRITICAL CVE CVE-2026-154107.2 HIGH CVE CVE-2026-8354810.0 CRITICAL CVE CVE-2026-835497.8 HIGHHow outlets covered it
SonicWall announced it will not patch two vulnerabilities, CVE-2026-109593 and CVE-2026-109594, affecting its end-of-life Global Management System (GMS) 9.5.2 and earlier versions. These flaws could allow unauthenticated file reads or post-authentication SQL injection, potentially exposing sensitive data or altering database records. Users are advised to upgrade to SonicWall Network Security Manager (NSM) due to the lack of remediation for these EoL products.
SonicWall has issued a warning about two unpatched security flaws, including CVE-2026-109593, affecting its end-of-life Global Management System (GMS) software, specifically versions 9.5.2 and earlier. The company will not release patches for these vulnerabilities and urges customers to migrate to the Network Security Manager (NSM) platform due to the product's end-of-life status.