Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

SonicWall warns of unpatched flaws in end-of-life GMS software

3 sources · 3 articlesFirst reported Updated ()1
What's new

2026-11-05: SOCRadar reports SonicWall GMS flaws remain unpatched following end of life, highlighting ongoing risks for users of the discontinued product.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

SonicWall confirms two unpatched vulnerabilities in end-of-life Global Management System allowing file reads and SQL injection.

SonicWall alerted customers to two security flaws in its Global Management System (GMS) 9.5.2 and earlier versions that will not receive patches. CVE-2026-109593 enables unauthenticated file reads, while CVE-2026-109594 allows SQL injection by high-privilege actors. The product has reached end-of-life so no remediation is planned. Users are urged to upgrade to the Network Security Manager platform. The issues could impact over 500,000 customers in 215 countries.

Key facts
  • Affects GMS 9.5.2 and earlier versions
  • CVE-2026-109593: unauthenticated file read
  • CVE-2026-109594: post-authentication SQL injection
  • No patches or updates planned
  • Upgrade to Network Security Manager recommended
  • Impacts over 500,000 customers in 215 countries
Analyze CVE-2026-109593 with Vani AIImpact, affected versions, exploitation, mitigations and detection

What each outlet adds

beyond the shared facts
  • BleepingComputerDetails impact on over 500,000 customers in 215 countries
  • The Hacker NewsNotes a separate SSRF flaw fixed one month earlier that was actively exploited
  • SOCRadarReports the flaws remain unpatched, highlighting ongoing risks
CVEs
CVE-2026-109593CVE-2026-109594
Vendors
SonicWall
Products
Global Management SystemNetwork Security ManagerGMS

Coverage

oldest first · one row per article · UTC
  1. · 5d ago BleepingComputerFirst report

    SonicWall warns of unpatched flaws in end-of-life GMS software

    Two flaws in SonicWall GMS 9.5.2 and earlier allow file reads and SQL injection but will not be patched as the product reaches end of life.

  2. · 4d ago The Hacker News

    SonicWall will not patch end-of-life GMS flaws

    SonicWall confirmed two vulnerabilities in end-of-life Global Management System that will not be fixed.

  3. · 4d ago SOCRadar

    SonicWall GMS Flaws Unpatched After End of Life

    SonicWall GMS has unpatched flaws after reaching end of life, exposing devices to risks.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109593
+1 related CVE
CVE-2026-109594
Unauthenticated file read in SonicWall GMS 9.5.2 and earlier
9.1
group max
—