SonicWall has warned customers about two security flaws in its Global Management System (GMS), the console IT admins use to manage many SonicWall appliances from one place, and said it will not fix them. GMS has reached end of life and has been replaced by the Network Security Manager (NSM) platform. “No remediation or security update will be released for these vulnerabilities,” SonicWall said, according to BleepingComputer, which adds that the company strongly encourages upgrading to NSM.
The first flaw, CVE-2026-109593, lets an unauthenticated attacker with network access to a vulnerable GMS instance read internal files and steal sensitive information. The second, CVE-2026-109594, is a low-complexity SQL injection that lets an attacker who already has high privileges read or modify data in the GMS database. Pentest-Tools researchers found and reported both. BleepingComputer’s article does not say either flaw is being exploited, but notes that attackers often target SonicWall products: it counts 19 SonicWall flaws added to CISA’s list of exploited vulnerabilities over four years, 13 of them also used by ransomware gangs.
How to check if you’re affected
Affected products are SonicWall GMS installations running version 9.5.2 or earlier. If your organization still runs GMS, it is affected; there will be no patched version to move to. BleepingComputer links SonicWall’s advisory SNWLID-2026-0019 for these flaws. That page loads as a script-driven shell for automated fetchers, so we could not read its contents here and rely on BleepingComputer’s account of it.
The only fix SonicWall points to is leaving GMS for NSM. Until that migration is done, the sources do not offer a workaround or mitigation, so check SonicWall’s advisory for any it lists.