SonicWall Won’t Patch Two GMS Vulnerabilities After End of Life
SonicWall warned of two vulnerabilities in its Global Management System. It will not release a fix for GMS 9.5.2 and earlier versions and recommends migrating to NSM.
SonicWall GMS vulnerabilities affect two flaws in the Global Management System (GMS), which has reached end of life. In security advisory SNWLID-2026-0019, the company confirmed that it will not release a fix or security update for GMS 9.5.2 and earlier versions. It recommends that organizations migrate to SonicWall Network Security Manager (NSM).
GMS is used to centrally manage SonicWall security devices. Users of the affected software therefore do not have a vendor-issued patch available and must address continued operation primarily through migration or decommissioning.
SonicWall GMS vulnerabilities include file reading and SQL injection
The first flaw is CVE-2026-109593, classified as unauthenticated file reading. According to the notice, an attacker with network access could gain access to internal files and sensitive data without logging into the system.
The second flaw, CVE-2026-109594, is an authenticated SQL injection vulnerability. Under certain conditions, it could allow data in the GMS database to be read or modified. Unlike the first vulnerability, it therefore requires obtaining the necessary access privileges.
SonicWall states that both flaws affect GMS 9.5.2 and earlier releases. Because the product has reached end of life, the vendor will not issue fixes or security updates for these vulnerabilities.
No vendor-issued patch is available for operators
The lack of a fix is particularly significant given GMS’s role in managing security infrastructure. The risk includes the possibility of obtaining internal files without authentication and modifying database records after authentication.
The vendor recommends switching to SonicWall Network Security Manager, abbreviated as NSM. Organizations that continue to use GMS should also strictly limit network access to the system.
For systems that cannot be migrated immediately, it is important to verify where they are deployed and assess their network accessibility.
Active attacks have not been confirmed so far
It has not been confirmed that CVE-2026-109593 or CVE-2026-109594 is being actively exploited in the wild. Likewise, the number of vulnerable instances and the extent of their potential exposure on the internet have not been independently confirmed.
Further developments may show whether SonicWall publishes technical measures beyond the recommended migration to NSM. Any information from security authorities, customers, or researchers about the availability of a public exploit or recorded attacks targeting these two vulnerabilities will also be relevant.
Sources
- SonicWall PSIRT — SNWLID-2026-0019 – Primary confirmation that SonicWall issued an advisory about two GMS flaws and will not release a fix for the product after EOL.
- The Hacker News – Lists the affected versions, the nature of both flaws, the CVE identifiers, and the recommendation to move to NSM.
- BleepingComputer – Independently confirms the absence of patches for GMS after EOL and describes the exploitation conditions.
- SonicWall — Global Management System – Confirms the discontinuation of GMS and positions NSM as its replacement.
Verified and updated: 11/05/2026 15:23
