Cisco and WatchGuard release patches; SonicWall leaves GMS unpatched
SonicWall will not patch two critical flaws in its end-of-life Global Management System.
60
CVE-2026-109593
Unauthenticated file read in SonicWall GMS 9.5.2 and earlier
- CVSS 3.1
- 9.1 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
An unauthenticated attacker with network access to SonicWall GMS 9.5.2 and earlier versions may read internal GMS files. This potentially exposes sensitive information. An attacker triggers the flaw remotely without authentication and gains access to internal files. SonicWall GMS users are affected.
What to do: SonicWall has not listed a fixed version. No workaround provided.
| Product | Affected |
|---|---|
| SonicWall GMS | 9.5.2 and earlier |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information.
- Weakness
- CWE-636
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
In the news
3 storiesSonicWall warns of unpatched flaws in end-of-life GMS software
Two flaws in SonicWall GMS 9.5.2 and earlier allow file reads and SQL injection but will not be patched as the product reaches end of life.
60
SonicWall will not patch end-of-life GMS flaws
SonicWall confirmed two vulnerabilities in end-of-life Global Management System that will not be fixed.
45