---
title: SonicWall won't patch two flaws in end-of-life GMS 9.5.2 and earlier, including an unauthenticated file read (CVE-2026-109593); move to NSM | ctxsec
url: https://ctxsec.com/items/sonicwall-gms-eol-cve-2026-109593-109594-no-patch-move-to-nsm
description: "SonicWall disclosed two flaws in its Global Management System, which manages fleets of SonicWall appliances. CVE-2026-109593 lets an unauthenticated attacker with network access read internal files; CVE-2026-109594 is a SQL injection that needs high privileges. Both affect GMS 9.5.2 and earlier. Because GMS is end-of-life, SonicWall says no fix or workaround will be released and recommends moving to Network Security Manager (NSM). Pentest-Tools found the bugs. No exploitation has been reported."
status: "official (SonicWall PSIRT SNWLID-2026-0019 as reported by BleepingComputer; NVD/GHSA CVE-2026-109593 record)"
published: 2026-11-04
---

> SonicWall disclosed two flaws in its Global Management System, which manages fleets of SonicWall appliances. CVE-2026-109593 lets an unauthenticated attacker with network access read internal files; CVE-2026-109594 is a SQL injection that needs high privileges. Both affect GMS 9.5.2 and earlier. Because GMS is end-of-life, SonicWall says no fix or workaround will be released and recommends moving to Network Security Manager (NSM). Pentest-Tools found the bugs. No exploitation has been reported.

[← Cybersecurity News](/news) · [markdown](/items/sonicwall-gms-eol-cve-2026-109593-109594-no-patch-move-to-nsm.md)

official (SonicWall PSIRT SNWLID-2026-0019 as reported by BleepingComputer; NVD/GHSA CVE-2026-109593 record)

2026-11-04

### SonicWall won't patch two flaws in end-of-life GMS 9.5.2 and earlier, including an unauthenticated file read (CVE-2026-109593); move to NSM

**What to do:** find any GMS consoles still running (virtual appliance or Windows install). Take them off the internet now and limit access to a management network, then plan the move to NSM. A management console can usually reach and configure every firewall it manages, so a file read that exposes credentials or config there is worth more than it looks. SonicWall bugs are frequent KEV entries (BleepingComputer counts 19), so expect this one to be scanned for.

Sources: [BleepingComputer: SonicWall warns of unpatched flaws in end-of-life GMS software (Nov 4)](https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-unpatched-flaws-in-end-of-life-gms-software/) · [NVD: CVE-2026-109593](https://nvd.nist.gov/vuln/detail/cve-2026-109593)