SonicWall published advisory SNWLID-2026-0019 on 3 November for two vulnerabilities in its Global Management System (GMS), versions 9.5.2 and earlier, and said no fix will follow because the product has reached end of life.
CVE-2026-109593 is an unauthenticated file read, rated 9.1 on CVSS v3. The advisory says an attacker with network access “may be able to read internal GMS files, potentially exposing sensitive information.” SonicWall classes the weakness as CWE-636, failing open. CVE-2026-109594 is a post-authentication SQL injection rated 6.8, which “in specific conditions could potentially allow an authenticated attacker to access or modify information stored in the GMS database.”
The advisory lists the workaround as “None” and the fixed version as unavailable, “as the product has reached End-of-Life (EOL).” SonicWall says organizations still running GMS “are strongly encouraged to upgrade to the SonicWall Network Security Manager (NSM).” It credits Matei ‘Mal’ Badanoiu and Andrei Lungu of Pentest-Tools.com with the reports. The advisory does not say either flaw is under attack.
For a team that still runs GMS, the usual patch ticket has no patch to track. The only controls left are limiting who can reach the GMS interface and moving the work to NSM on a dated plan. Both belong on the exposure register today, because the file-read flaw needs no login.
In our reading, an end-of-life notice that arrives with working vulnerabilities turns a support date into a deadline. An asset inventory that records each product’s end-of-support date, with a named owner, can flag GMS before an advisory does. We covered the pressure on SonicWall’s SMA1000 line when we reported exploitation attempts against a SonicWall SMA1000 flaw, and the pattern of exposed management consoles recurs in Palo Alto Networks updated PAN-OS for a management interface flaw.
