SonicWall has published advisory SNWLID-2026-0019, disclosing two vulnerabilities in the centralized management system Global Management System (GMS) version 9.5.2 and earlier. The product is End-of-Life, and the vendor has explicitly stated there will be no fixes. Organizations that continue to use GMS are advised to migrate to SonicWall Network Security Manager (NSM). One of the vulnerabilities — unauthenticated file reading with a CVSS score of 9.1 — poses a serious risk of confidential data exposure.
Technical details of the vulnerabilities
The advisory covers two flaws affecting SonicWall GMS 9.5.2 and earlier versions:
- CVE-2026-109593 (CVSS 9.1) — an unauthenticated arbitrary file read vulnerability. An attacker with network access to GMS can read internal system files, potentially leading to leakage of sensitive information: configurations, credentials, keys. The entry in the GitHub Advisory Database confirms the description and CVSS score.
- CVE-2026-109594 (CVSS 6.8) — SQL injection (CWE-89) that requires authentication. Under certain conditions, an authenticated attacker can gain access to data in the GMS database or modify it. The CVSS score of 6.8 corresponds to a medium severity level rather than critical — it is important not to lump both vulnerabilities together as equally dangerous.
The key difference between them is that CVE-2026-109593 can be exploited without any authentication, which makes it significantly more dangerous in scenarios where GMS is accessible from the network. CVE-2026-109594 requires prior acquisition of credentials, which narrows the attack vector, but in combination with the first vulnerability (which can expose credentials) it creates a potential exploitation chain.
Two parallel response tracks
The situation around SonicWall currently requires organizations to separate two independent issues. For GMS 9.5.2 and earlier, the vendor does not provide and does not plan to provide patches — the only recommended path is full migration to NSM. For SonicWall SMA1000, affected by the previously disclosed CVE-2026-102255 vulnerability (CVSS 10.0, unauthenticated SSRF), a patch is available and should be applied immediately — the affected versions are 12.4.3-03526 and earlier, as well as 12.5.0-02952 and earlier.
According to Previdian, sensors recorded attempts to exploit CVE-2026-102255 between October 9 and November 4, 2026 — about 2,985 attempts from 10 unique IP addresses across three countries. An important caveat: Previdian explicitly notes that this telemetry reflects exploitation attempts, not confirmed successful compromises. As of publication, CVE-2026-102255 has not been added to the CISA KEV catalog. We have already covered this vulnerability earlier.
Impact assessment
GMS is a centralized management platform for SonicWall network devices. Compromise of such a system can potentially give an attacker access to the configurations of all managed devices, including firewalls and VPN gateways. The unauthenticated file read vulnerability (CVE-2026-109593) is especially dangerous for organizations where GMS is accessible from an internal network with insufficient segmentation or, worse, from the internet.
The vendor’s refusal to release patches is standard practice for End-of-Life products, but it leaves organizations with a stark choice: either accept an unmitigable risk or carry out a migration. SonicWall has not offered any interim solutions.
Practical recommendations
- For GMS 9.5.2 and earlier: start planning migration to SonicWall NSM. Until migration is complete, restrict network access to GMS to the minimum necessary set of IP addresses and segments.
- For SMA1000: apply the available updates immediately, verify that the management interface is not exposed to the internet, and configure monitoring for requests matching SSRF exploitation patterns.
- Conduct an audit: determine whether the affected versions of GMS or SMA1000 are in use in your infrastructure. For GMS, check the version through the administrative console.
- If migration to NSM is not feasible in the short term, isolate GMS in a separate network segment with strict access control and enhanced monitoring.
Organizations using SonicWall GMS 9.5.2 and earlier should treat migration to NSM not as a routine upgrade, but as a response measure to a security incident. The CVE-2026-109593 vulnerability, with a CVSS score of 9.1 and no authentication requirement, makes every day of operating the legacy system a period of elevated risk. In parallel, you should make sure that deployed SMA1000 instances are updated, given the active attempts to exploit CVE-2026-102255.
