Vulnerabilities & Exploits

SonicWall GMS flaws leave operators without a fix

INCIBE-CERT reports two flaws in SonicWall Global Management System (GMS) 9.5.2 and earlier, affecting Virtual Appliance and Windows deployments. SonicWall says it will provide neither a corrected release nor a workaround, and recommends migration to Network Security Manager (NSM).

CVE-2026-109593 lets an unauthenticated attacker with network access read internal GMS files, potentially exposing sensitive information. The second flaw is a medium-severity structured query language (SQL) injection that requires authentication; the advisory does not specify what database information it could expose.

For organizations still running reachable GMS, both flaws remain unresolved until the product is replaced. Continued operation leaves the unauthenticated file-reading path open, while the specific data at risk and any downstream impact remain unclear.

4 sources · 1h ago

CVE-2026-109593

NVD KEV

CVSS 9.1 CRITICAL: an unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read…

CVE-2026-109594

NVD KEV

CVSS 6.8 MEDIUM: post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')…

Timeline

Nov 4 Reported by The Hacker News
Nov 3 Reported by SonicWall PSIRT

Sources

Nov 4 The Hacker News
SonicWall Won't Patch EoL GMS Flaws That Could Expose Files, Alter Database Records
SonicWall warns two flaws in end-of-life GMS 9.5.2 and earlier will remain unpatched, allowing file reads or SQL injection under specific conditions.
original
Nov 4 BleepingComputer
SonicWall warns of unpatched flaws in end-of-life GMS software
SonicWall warned customers of two security flaws affecting end-of-life Global Management System (GMS) systems that will not be patched.
original
Nov 4 INCIBE-CERT
Múltiples vulnerabilidades en GMS de SonicWall
Matei «Mal» Badanoiu y Andrei Lungu, de Pentest-Tools.com, han informado sobre dos vulnerabilidades en
original

Vendor digest: SonicWall

Part of the PlainSec briefing for 2026-11-04

Every edition of this story: SonicWall GMS flaws leave operators without a fix

More from today

Vulnerabilities & ExploitsSonicWall GMS flaws leave operators without a fixINCIBE-CERT reports two flaws in SonicWall Global Management System (GMS) 9.5.2 and earlier, affecting Virtual Appliance and Windows deployments. SonicWall says it will provide neither a corrected release nor a workaround, and recommends migration to Network Security Manager (NSM).CVE-2026-109593 lets an unauthenticated attacker with network access read internal GMS files, potentially exposing sensitive information. The second flaw is a medium-severity structured query language (SQL) injection that requires authentication; the advisory does not specify what database information it could expose.For organizations still running reachable GMS, both flaws remain unresolved until the product is replaced. Continued operation leaves the unauthenticated file-reading path open, while the specific data at risk and any downstream impact remain unclear.4 sources · 1h ago

CVE-2026-109593

NVD KEV

CVSS 9.1 CRITICAL: an unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read…

CVE-2026-109594

NVD KEV

CVSS 6.8 MEDIUM: post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')…

Timeline

Nov 4 Reported by The Hacker News

Nov 3 Reported by SonicWall PSIRT

Sources

Nov 4 The Hacker News

SonicWall Won't Patch EoL GMS Flaws That Could Expose Files, Alter Database Records

SonicWall warns two flaws in end-of-life GMS 9.5.2 and earlier will remain unpatched, allowing file reads or SQL injection under specific conditions.

original

Nov 4 BleepingComputer

SonicWall warns of unpatched flaws in end-of-life GMS software

SonicWall warned customers of two security flaws affecting end-of-life Global Management System (GMS) systems that will not be patched.

original

Nov 4 INCIBE-CERT

Múltiples vulnerabilidades en GMS de SonicWall

Matei «Mal» Badanoiu y Andrei Lungu, de Pentest-Tools.com, han informado sobre dos vulnerabilidades en

original

Vendor digest: SonicWallPart of the PlainSec briefing for 2026-11-04Every edition of this story: SonicWall GMS flaws leave operators without a fixMore from today

WordPress upgrade window opens a path to server code

PHP2Shell chain now reaches root on firewalls

CryptoPayment Gateway flaw exposes stored wallet keys