SonicWall warns of unpatched flaws in end-of-life GMS software
Two flaws in SonicWall GMS 9.5.2 and earlier allow file reads and SQL injection but will not be patched as the product reaches end of life.
SonicWall alerted customers to two security flaws in its Global Management System that will not receive patches. The vulnerabilities affect GMS 9.5.2 and earlier versions. CVE-2026-109593 enables unauthenticated attackers to read internal files. CVE-2026-109594 allows high-privilege actors to access or modify the GMS database via SQL injection. SonicWall urges customers to upgrade to the Network Security Manager platform.
- GMS replaced by Network Security Manager.
- Vulnerabilities affect GMS 9.5.2 and earlier.
- No security updates released.
- Customers strongly encouraged to upgrade.
- Affects over 500,000 customers in 215 countries.
Impact: unauthenticated file read and SQL injection in management interface
- 1.Upgrade to SonicWall Network Security Manager
- 2.Monitor for unpatched GMS instances
- Vendors
- SonicWall
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109593+1 related CVE | Unauthenticated file read in SonicWall GMS 9.5.2 and earlier | 9.1 group max | — |
From the original article
2 min read at bleepingcomputer.com
SonicWall warned customers of two security flaws affecting end-of-life Global Management System (GMS) systems that will not be patched. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.