SonicWall has identified two vulnerabilities impacting end-of-life Global Management System (GMS) systems, which it stated will not be patched This article explores sonicwall identified vulnerabilities. . The specific details of the security flaws, which affect SonicWall GMS 9.5.2 and earlier versions, are provided below.
CVE-2026-109593 (SonicWall) - An unauthenticated file read vulnerability that could enable an attacker with network access to read internal GMS files, potentially exposing sensitive information.
CVE-2026-109594 (SonicWall) - A post-authentication SQL injection vulnerability that could allow an authenticated attacker to access or modify information stored in the GMS database under specific conditions. "The affected product has reached End-of-life (EoL)," SonicWall announced in a Tuesday alert. As a consequence, no patches or security updates will be released for these vulnerabilities.
Organizations using the product should be aware of the associated security risks and are strongly advised to upgrade to the SonicWall Network Security Manager (NSM).
This development occurred less than a month after SonicWall addressed the critical pre-authenticated server-side request forgery (SSRF) flaw in CVE-2026-102255, which could have enabled attackers to access internal functionalities and carry out unauthorized operations. The vulnerability has been actively exploited in the wild since October 9, 2026, with telemetry data from Previdian showing 2,541 attack attempts from eight distinct IP addresses originating from Singapore and the U.S. Additionally, as of November 3, 2026, 30 exploitation attempts were recorded.
